⬢ DragonFlyBSD Kernel Audit
DF-3481 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
{
  "finding_id": "DF-3481",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "v1 ng_ppp (LIVE stack, LEGACY bucket) guards NONE of its private state (no lock/token/BGL anywhere in ng_ppp.c): the frags TAILQ, qlen, mseq/xseq, activeLinks and conf are mutated by ng_ppp_mp_input/frag_process/get_packet/frag_trim/frag_checkstale/frag_reset/rmnode without any serialization, and v1 (unlike netgraph7s cpu0 item funnel, DF-0330) has structurally concurrent execution contexts: cpu0-netisr control plane (ngc_send, uipc_socket.c:259 port), cpuN-netisr ksocket upcalls (inline in sowakeup, uipc_socket2.c:604), the BGL-held 0.5s fragTimer (plain callout_init => kern_timeout.c:580 get_mplock), and process-thread ng_iface output (no BGL, no netisr). Extensive adversarial attempts on the stock INVARIANTS guest did NOT reproduce corruption: 4000+2000 SET_CONFIG-toggle frag_reset races at ~700k deliveries/s across CPU-hashed pump flows, 700 shutdown-vs-inflight races, and 1600 dup-hammer timer-stale cycles over 8 staggered bundles all ran clean. The negative result is explained by undocumented funnels: connected-socket ksocket feeds forward delivery through the sockets cpu0 protocol port (and the soclose token handshake serializes shutdown), so every harness-reachable inbound pair executes serialized on stock topologies -- mirroring netgraph7s DF-0330 latent verdict. The defect remains certain by inspection and is one refactor (MPSAFE soreceive, port selection, any non-socket feeder such as ng_ether-fed PPPoE bundles with multi-CPU input hashing) away from racing; primitive if raced: double TAILQ_REMOVE/kfree of struct ng_ppp_frag + double m_freem (reclaim-exploitable heap corruption). Fix authored and regression-tested (per-node lwkt_token), not race-validated because no collision was achievable.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-3481/VERDICT.md \u2014 full containment analysis and attempt log",
    "findings/poc/DF-3481/pppfragrace.c \u2014 8-bundle sticker/park/stale/dup-hammer timer race harness",
    "findings/poc/DF-3481/pppteardown.c \u2014 shutdown (mode 0) and SET_CONFIG-toggle (mode 1) race harness",
    "findings/poc/DF-3481/run.log \u2014 timer-race cycles completing without panic",
    "findings/poc/DF-3481/run.teardown.log \u2014 teardown attempts completing without panic",
    "findings/poc/DF-3481/fix_regression.log \u2014 patched ng_ppp.ko (per-node token) survives toggle storm + frag cycles",
    "findings/poc/DF-3481/fix.diff \u2014 per-node lwkt_token serialization (compiles -Werror)"
  ],
  "kernel_refs": [
    "sys/netgraph/ppp/ng_ppp.c:1144",
    "sys/netgraph/ppp/ng_ppp.c:1210",
    "sys/netgraph/ppp/ng_ppp.c:1290",
    "sys/netgraph/ppp/ng_ppp.c:1364",
    "sys/netgraph/ppp/ng_ppp.c:1447",
    "sys/netgraph/ppp/ng_ppp.c:1876",
    "sys/netgraph/ppp/ng_ppp.c:791",
    "sys/netgraph/netgraph/ng_base.c:2034",
    "sys/kern/kern_timeout.c:580",
    "sys/kern/uipc_socket.c:259",
    "sys/kern/uipc_socket2.c:604",
    "sys/netgraph/ksocket/ng_ksocket.c:1097"
  ],
  "poc_changes": "Initial design parked stale packets behind a first-only blocker with sequence gaps; that is invisible to ng_ppp_frag_checkstale because its running-seq scanner desyncs at any gap (the DF-0386 defect) -- final design pins mseq with a middle-frag sticker on a second link and uses strict head-contiguity. Dup-seq hammer fragments walk the full queue (TAILQ_FOREACH_REVERSE in ng_ppp_mp_input) without inserting, so only the timer delivers stale batches. AF_NETGRAPH sockaddr paths longer than ~14 chars are truncated by the socket layer (sendto returns ENOENT); all node/hook names were shortened accordingly. mkpeer must target the OWNING node (f1:), not the peer path. Leftover graphs hold UDP ports forever, so ports are allocated dynamically each run.",
  "attempts": 9,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5400,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -w -pthread -o pppfragrace pppfragrace.c; cc -O2 -w -pthread -o pppteardown pppteardown.c; kldload ng_socket ng_ppp ng_ksocket",
  "run_cmd": "./pppfragrace 200; ./pppteardown 4000 1",
  "code_hash": "0507441deb7ab23e7fc8445cbcb13c6359c52f47b978848956e54c504b23303f",
  "notes": "Side discovery for the orchestrator (out of this files scope): ng_iface and ng_eiface node creation panics the stock kernel deterministically (panic: trying to free NULL pointer in ng_iface_constructor+0x3a2 / ng_eiface_constructor+0xf6 via plain root ngctl mkpeer . iface i0 inet on a fresh boot) -- logs preserved in findings/poc/DF-3482/. Both node types are unusable on this kernel, which also blocked the ng_iface-output race topologies. Guest was reset with-src after fix validation.",
  "recommended_fix": "Add a per-node lwkt_token to ng_ppp_private acquired at every entry point (rcvmsg/newhook/rcvdata/rmnode/disconnect/frag_timeout) -- see fix.diff; porting netgraph7s per-node writer token is the long-term fix.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: (ng_ppp.ko rebuilt in-guest with per-node token; netgraph.ko rebuilt with DF-3483 fix)",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched module compiles (-Werror) and survives 1000 config-toggle storms + 160 frag-race cycles with the data path functional (fix_regression.log). Race-validated fix is not possible because the baseline race never collided on stock topologies (socket-port funnel).",
  "fix_evidence": "findings/poc/DF-3481/fix_regression.log"
}