DF-0314
Inconsistent privilege enforcement: RFC3542 GET path lacks priv check present in RFC2292 path
Summary
RFC2292 GET for HOPOPTS/DSTOPTS requires priv(:1700-1720). RFC3542 GET via ip6_getpcbopt(:1942-1969) has NO priv check. fd-passing -> unpriv reads sticky ext headers. Low impact: DF-0313 blocks setsockopt path so sticky headers unreachable via setsockopt today.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0314 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 391 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netinet6/ip6_output.c:1942: RFC3542 GET path lacks priv check present in RFC2292 path
Verified recommended fix
Source-confirmed at sys/netinet6/ip6_output.c:1942: RFC3542 GET path lacks priv check present in RFC2292 path
Verdict
Source-confirmed at sys/netinet6/ip6_output.c:1942: RFC3542 GET path lacks priv check present in RFC2292 path
No comments yet.