⬢ DragonFlyBSD Kernel Audit
DF-3304 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-3304",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Unprivileged local user (uid 32767 child) crashes the kernel with one UDP datagram after setsockopt(IP_MULTICAST_VIF) on a plain UDP socket: ip_output keeps imo (rsvp_on!=0), X_ip_mforwards imo fast path calls ip_mdq(m,ifp,NULL,vifi), the REGISTER vif routes it to pim_register_send(...,rt=NULL), which reads rt->mfc_rp at NULL+0x90 when mrt_api_config has MRT_MFC_RP. Fatal trap 12 at 0x90 in pim_register_send+0x1de, reproduced twice from clean boot on a PIM kernel (options MROUTING+PIM; the stock ip_mroute.ko module builds without PIM so module-only systems are not reachable). Fix (rt!=NULL guard) verified on rebuilt kernel #1: trigger runs clean, no panic.",
  "exploit_chain": "unpriv UDP socket -> setsockopt(IP_MULTICAST_VIF=reg_vif, no priv check) -> sendto(224.9.9.9) -> ip_output (ip_mrouter set, rsvp_on, group not joined) -> X_ip_mforward(imo) -> ip_mdq(rt=NULL) -> pim_register_send -> rt->mfc_rp NULL deref -> panic. Ceiling: kernel panic/DoS only (NULL read, no controlled write).",
  "evidence": [
    "run.log: trigger uid=32767, IP_MULTICAST_VIF rc=0, then Fatal trap 12",
    "panic.txt: fault virtual address 0x90, Stopped at pim_register_send+0x1de movl 0x90(%r13),%r10d",
    "fix_run.log: patched kernel child status 0x0, no panic observed"
  ],
  "kernel_refs": [
    "sys/net/ip_mroute/ip_mroute.c:1186",
    "sys/net/ip_mroute/ip_mroute.c:1468",
    "sys/net/ip_mroute/ip_mroute.c:2826",
    "sys/netinet/ip_output.c:1479",
    "sys/netinet/ip_output.c:425",
    "sys/netinet/udp_usrreq.c:268"
  ],
  "poc_changes": "Fixed nested /* */ in header comment; added sys/param.h; trigger child setuid(32767); needed kernel with options MROUTING+options PIM (built PIMTEST config, nativekernel) because ip_mroute.ko is built without PIM.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Sep 10 09:22:03 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PIMTEST x86_64",
  "runtime_sec": 300,
  "guest_dirty": 1,
  "build_cmd": "cc -O2 -Wall -o regvifnull regvifnull.c",
  "run_cmd": "./regvifnull   (root setup; uid-32767 child sends the trigger)",
  "code_hash": "aff8c72ffbec6abbf128582d12f5d2853d6d3614d1dca6c8a6f77967a314b184",
  "notes": "Preconditions set up by root in the PoC: MRT_INIT + VIFF_REGISTER vif + MRT_API_CONFIG(MRT_MFC_RP) (pimd) + IP_RSVP_VIF_ON (rsvpd, keeps imo alive in ip_output). ip_mroute.ko module path cannot reach this (Makefile lacks -DPIM).",
  "recommended_fix": "pim_register_send(): take the upcall branch when rt==NULL: if (rt != NULL && (mrt_api_config & MRT_MFC_RP) && ...); consider priv_check for IP_MULTICAST_VIF.",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Thu Sep 10 10:33:47 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PIMTEST x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Rebuilt kernel with fix.diff (rt!=NULL guard): regvifnull completes, child exits 0, no panic (fix_run.log). Baseline panicked deterministically.",
  "fix_evidence": "fix_run.log; fix_build.log (kernel #1 built 10:37:50, installed 10:38:26, uname #1 10:33:47)"
}