⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0427

ip6_mrouter_set performs no explicit capability check: relies entirely on raw-socket attach privilege

Summary

ip6_mrouter_set(:265-271) gates only on so!=ip6_mrouter&&name!=MRT6_INIT -> EACCES. Never calls caps_priv_check/priv_check. Indirectly gated by raw IPv6 socket (rip6_attach SYSCAP_NONET_RAW). Every other netinet6 control path does explicit caps_priv_check. Defense-in-depth gap; risk if raw-socket check loosened.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0427 · 1 files
FileTypeDescriptionSize
manifest.json file 391 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/netinet6/ip6_mroute.c:265: ip6_mrouter_set performs no explicit capability check

Verified recommended fix

Source-confirmed at sys/netinet6/ip6_mroute.c:265: ip6_mrouter_set performs no explicit capability check

Verdict

Source-confirmed at sys/netinet6/ip6_mroute.c:265: ip6_mrouter_set performs no explicit capability check