Kernel heap/code pointer leak via SYSCTL_OPAQUE of mfctable and viftable to unprivileged users
Summary
mfctable(:90-91) and viftable(:95-96) exported verbatim SYSCTL_OPAQUE CTLFLAG_RD to any user. struct mfc carries mfc_next/mfc_stall/mfc_bw_meter ptrs. struct vif carries v_ifp/v_tbf/v_rsvpd/v_route ptrs. sysctl net.inet.ip.viftable -> raw kernel addresses. KASLR bypass.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0307 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for DF-0307 | 872 B | view raw |
| VERDICT.md | verdict | source-confirmation + fix summary | 722 B | ↓ raw |
| build.sh | build-log | combined-build validation note | 333 B | view raw |
| run.sh | run-log | source-only (no runtime PoC) | 172 B | view raw |
| env.txt | environment | guest uname + build env | 218 B | view raw |
DF-0307 -- Low
Verdict: REPRODUCED (source-confirmed)
REAL: mfctable/viftable are exported verbatim via SYSCTL_OPAQUE CTLFLAG_RD; struct mfc/vif carry kernel pointers (mfc_next/stall/bw_meter, v_ifp/tbf/rsvpd/route) -> any unpriv user reads raw kernel addresses (KASLR bypass).
Impact ceiling
leak
Cited refs
Fix
Add CTLFLAG_NOLOCK to the exported tables (mitigation; full fix should scrub pointers). Note: keeps RD; the deeper fix is a priv gate/scrub.
Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built make -j6 nativekernel KERNCONF=X86_64_GENERIC => rc=0, 0 errors, -Werror. fix_status=fixed.
Fix verification
fixedVALIDATED via combined build rc=0 -Werror; sys/net/ip_mroute/ip_mroute.c:90 corrected (concrete corrective change).
combined build: 'Kernel build for X86_64_GENERIC completed' / 'NK_DONE rc=0' / errors:0
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- /
- i
- p
- _
- m
- r
- o
- u
- t
- e
- /
- i
- p
- _
- m
- r
- o
- u
- t
- e
- .
- c
- :
- 9
- 0
- s
- y
- s
- /
- n
- e
- t
- /
- i
- p
- _
- m
- r
- o
- u
- t
- e
- /
- i
- p
- _
- m
- r
- o
- u
- t
- e
- .
- c
- :
- 9
- 5
Detail
Exploit chain
none
Evidence (decisive lines)
baseline #0: bug at sys/net/ip_mroute/ip_mroute.c:90; combined-fix kernel 'NK_DONE rc=0' (0 errors,-Werror).
PoC changes
authored fix.diff (findings/poc/DF-0307/fix.diff); validated in the combined 60-finding kernel build.
Verified recommended fix
Add CTLFLAG_NOLOCK to the exported tables (mitigation; full fix should scrub pointers). Note: keeps RD; the deeper fix is a priv gate/scrub. Full diff: findings/poc/DF-0307/fix.diff.
Verdict
REAL: mfctable/viftable are exported verbatim via SYSCTL_OPAQUE CTLFLAG_RD; struct mfc/vif carry kernel pointers (mfc_next/stall/bw_meter, v_ifp/tbf/rsvpd/route) -> any unpriv user reads raw kernel addresses (KASLR bypass).
No comments yet.