⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0500

Response handlers trust count/size fields without checking pcb->msg arglen: defense-in-depth gap

Summary

GET_CON_LIST(:920-928) copies p1->num_connections*elem without checking arglen>=sizeof(*p1)+count*elem. PING(:1048-1054) copies op->echo_size. GET_INFO(:1106-1115) copies op->info_size. Same for GET_CHAN_LIST(:972-983). Currently safe only because L2CAP layer sizes response to match. Any future divergence -> heap OOB read copyout to userspace. Fix: validate arglen before each copyout.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0500 · 1 files
FileTypeDescriptionSize
manifest.json file 419 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:917: response handlers trust count/size without checking pcb->msg arglen

Verified recommended fix

Source-confirmed at sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:917: response handlers trust count/size without checking pcb->msg arglen

Verdict

Source-confirmed at sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:917: response handlers trust count/size without checking pcb->msg arglen