DF-0408
ip_optcopy validates IP-option lengths only with KASSERT (no-op on production): latent OOB read
Summary
ip_optcopy(:1018-1042): option length validation via KASSERT only (compiled out without INVARIANTS). On production: cp[IPOPT_OLEN] read for any non-EOL/NOP byte even when cnt==1 -> 1-byte OOB read past IP header options. Relies on comment "bogus lengths should have been caught by ip_dooptions". All current producers validate, but latent if invariant breaks.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0408 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 394 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netinet/ip_output.c:1018: ip_optcopy validates IP-option lengths only with KASSERT (latent OOB read)
Verified recommended fix
Source-confirmed at sys/netinet/ip_output.c:1018: ip_optcopy validates IP-option lengths only with KASSERT (latent OOB read)
Verdict
Source-confirmed at sys/netinet/ip_output.c:1018: ip_optcopy validates IP-option lengths only with KASSERT (latent OOB read)
No comments yet.