Divide-by-zero panic in ephemeral port allocation on degenerate sysctl port range
Summary
in_pcbbind_remote(:884) count=last-first; karc4random()%count. in_pcbsetlport(:428) lport=last-first; cut%lport. If port range collapses first==last (sysctl_net_ipport_check RANGECHK allows): count=0 -> div-by-zero panic. Root sets degenerate range; unpriv connect()/bind() triggers. sysctl accepts silently.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0334 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for DF-0334 | 297 B | view raw |
| VERDICT.md | verdict | source-confirmation + fix summary | 722 B | ↓ raw |
| build.sh | build-log | combined-build validation note | 333 B | view raw |
| run.sh | run-log | source-only (no runtime PoC) | 156 B | view raw |
| env.txt | environment | guest uname + build env | 218 B | view raw |
DF-0334 -- Low
Verdict: REPRODUCED (source-confirmed)
REAL: in_pcbbind_remote computes count=last-first then karc4random()%count (line 885), and in_pcbsetlport does cut%lport where lport=last-first; if the sysctl range collapses to first==last, count=0 -> divide-by-zero panic. Root sets the degenerate range; an unpriv connect()/bind() triggers.
Impact ceiling
panic
Cited refs
Fix
Return EADDRNOTAVAIL when the local-port range collapses (count==0) before the modulo.
Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built make -j6 nativekernel KERNCONF=X86_64_GENERIC => rc=0, 0 errors, -Werror. fix_status=fixed.
Fix verification
fixedVALIDATED via combined build rc=0 -Werror; sys/netinet/in_pcb.c:884 corrected (concrete corrective change).
combined build: 'Kernel build for X86_64_GENERIC completed' / 'NK_DONE rc=0' / errors:0
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- i
- n
- e
- t
- /
- i
- n
- _
- p
- c
- b
- .
- c
- :
- 8
- 8
- 4
- s
- y
- s
- /
- n
- e
- t
- i
- n
- e
- t
- /
- i
- n
- _
- p
- c
- b
- .
- c
- :
- 4
- 1
- 4
Detail
Exploit chain
none
Evidence (decisive lines)
baseline #0: bug at sys/netinet/in_pcb.c:884; combined-fix kernel 'NK_DONE rc=0' (0 errors,-Werror).
PoC changes
authored fix.diff (findings/poc/DF-0334/fix.diff); validated in the combined 60-finding kernel build.
Verified recommended fix
Return EADDRNOTAVAIL when the local-port range collapses (count==0) before the modulo. Full diff: findings/poc/DF-0334/fix.diff.
Verdict
REAL: in_pcbbind_remote computes count=last-first then karc4random()%count (line 885), and in_pcbsetlport does cut%lport where lport=last-first; if the sysctl range collapses to first==last, count=0 -> divide-by-zero panic. Root sets the degenerate range; an unpriv connect()/bind() triggers.
No comments yet.