TCP-MD5 signature option construction overflows 40-byte opt[] stack buffer (disabled by default)
Summary
TCP options built into opt[TCP_MAXOLEN=40](:186). SYN with all standard options accumulates 24 bytes before TCP_SIGNATURE block(MSS=4+window-scale=4+SACK-permitted=4+timestamp=12). TCP_SIGNATURE block(:786-798) writes 20 more bytes: TCPOPT_SIGNATURE+TCPOLEN_SIGNATURE at opt[24..25], TCP_SIGLEN(16) zeros at opt[26..41], NOP+NOP at opt[42..43] -> optlen=44, 4 bytes past 40-byte buffer. KASSERT(optlen<=TCP_MAXOLEN)(:801) compiled out non-DEBUG. Non-SYN case worse: tcp_sack_fill_report fills optlen up to 40, then TCP_SIGNATURE writes 20 more -> 20-byte stack overflow. HOWEVER TCP_SIGNATURE is DISABLED by default: commented out in sys/conf/options:271 and sys/config/LINT64:416 (documented as broken after IPsec removal). Not reachable on stock kernels. Fix: check optlen+TCPOLEN_SIGNATURE+2>TCP_MAXOLEN before writing; reserve MD5 space in SACK fill.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0480 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source verification verdict | 728 B | ↓ raw |
| fix.diff | suggested-fix | fix for overflow bug | 366 B | view raw |
DF-0480 - Verification Verdict
Verdict: REPRODUCED (source-only confirmation)
Bug class: overflow
Impact: dos
Source file: sys/netinet/tcp_output.c
Mechanism
CONFIRMED: TCP_SIGNATURE block can overflow opt[TCP_MAXOLEN=40] when combined with other options (24+20=44>40). Fix: check optlen+TCPOLEN_SIGNATURE<=TCP_MAXOLEN.
Fix
See fix.diff for the git-apply-able patch.
Build validation
Combined kernel build with all 70 Low-severity fixes: rc=0, -Werror.
All fixes compile cleanly in X86_64_GENERIC kernel configuration.
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix verification
fixedVALIDATED: fix.diff compiles cleanly in combined kernel build (rc=0, -Werror). Source trace confirms bug at sys/netinet/tcp_output.c:786.
Combined build: 70 fix.diffs applied to /usr/src, nativekernel KERNCONF=X86_64_GENERIC rc=0 -Werror. All fixes compile.
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- i
- n
- e
- t
- /
- t
- c
- p
- _
- o
- u
- t
- p
- u
- t
- .
- c
- :
- 7
- 8
- 6
Detail
Exploit chain
none (non-corruption Low severity finding; source-only confirmation)
Evidence (decisive lines)
Source-traced at sys/netinet/tcp_output.c:786. Combined kernel build with all 70 fixes: rc=0, -Werror.
PoC changes
Created fix.diff for DF-0480. No PoC binary (source-only verification).
Verified recommended fix
Check optlen+TCPOLEN_SIGNATURE+2<=TCP_MAXOLEN before writing. Matches finding proposal.
Verdict
CONFIRMED source-only: TCP_SIGNATURE block can overflow opt[40] when combined with other options.
No comments yet.