DF-0273 PoC — SIOCSIFDESCR fall-through to SIOCSIFFLAGS

Build

cc -o descr_fallthrough descr_fallthrough.c

Run (as root — SIOCSIFDESCR requires RESTRICTEDROOT)

./descr_fallthrough

Expected (bug present)

[*] lo0 flags BEFORE SIOCSIFDESCR:
  flags=...<UP,RUNNING,MULTICAST,...>
[*] lo0 flags AFTER SIOCSIFDESCR(len=2):
  flags=...<RUNNING,MULTICAST,...>      <-- IFF_UP CLEARED
[!] DF-0273 REPRODUCED: IFF_UP cleared by setting a description

Expected (fixed)

Flags unchanged after SIOCSIFDESCR — the break; prevents fall-through.

DF-0273 — SIOCSIFDESCR missing break → fall-through to SIOCSIFFLAGS

Verdict: REPRODUCED

Impact: privileged-ioctl logic corruption (interface flag manipulation). Setting an interface description via SIOCSIFDESCR corrupts the interface flags because the case SIOCSIFDESCR block in sys/net/if.c has no break before case SIOCSIFFLAGS. The fall-through reinterprets ifr_buffer.length (which aliases ifr_flags via the ifr_ifru union, sys/net/if.h:259-261) as the new flags value.

Mechanism

1. sys/net/if.c:2100 — case SIOCSIFDESCR: sets ifp->if_description and at line 2131-2132 frees the old description buffer.
2. No break; between line 2132 and case SIOCSIFFLAGS: at line 2134.
3. Execution falls through into the SIOCSIFFLAGS handler at line 2138: new_flags = (ifr->ifr_flags & 0xffff) | (ifr->ifr_flagshigh << 16).
4. Because ifr_flags is ifr_ifru.ifru_flags[0] which overlaps the low 16 bits of ifr_ifru.ifru_buffer.length (both start at offset 0 of the union, if.h:244-261), new_flags is driven by the description length.
5. For a 2-byte description ("a\0"), new_flags = 2 (IFF_BROADCAST, no IFF_UP). Line 2142-2144: if (ifp->if_flags & IFF_UP && (new_flags & IFF_UP)==0) → if_down(ifp) — the interface goes DOWN.

Demonstration

Tested on the guest (root; SIOCSIFDESCR requires caps_priv_check(SYSCAP_RESTRICTEDROOT)):

[*] lo0 flags BEFORE SIOCSIFDESCR:
  flags=0xffff8041 <UP,RUNNING,MULTICAST,PPROMISC,>
[*] lo0 flags AFTER SIOCSIFDESCR(len=2):
  flags=0xffff8040 <RUNNING,MULTICAST,PPROMISC,>

[!] DF-0273 REPRODUCED: IFF_UP cleared by setting a description
    (fall-through SIOCSIFDESCR -> SIOCSIFFLAGS).
[!] new_flags was driven by ifr_buffer.length==2 (IFF_BROADCAST),
    bypassing the SIOCSIFFLAGS intent.

Setting a description of length 2 cleared IFF_UP on lo0 — the interface was brought down by a description-set ioctl.

Threat model

This is a privileged bug (SIOCSIFDESCR requires RESTRICTEDROOT = root, CVSS PR:H). The realistic impact is operational: a root admin action (ifconfig em0 description "...") has the unintended side effect of corrupting interface flags — bringing the interface down, or setting arbitrary flag bits via the description length. On vtnet0 (the management interface), ifconfig vtnet0 description "a" would drop the admin's SSH session. This is a logic/operational bug, not a privilege escalation.

Fix

Add break; after the kfree(odescrbuf) in the SIOCSIFDESCR case (sys/net/if.c:2132). See fix.diff.

PoC changes

Wrote descr_fallthrough.c from scratch (the poc dir was empty). The PoC creates a throw-away interface, brings it UP, issues SIOCSIFDESCR with a description whose length aliases to a flag value, and reports the before/after flags to confirm the fall-through.