L2CAP ConfigReq unknown-option echo inflates m_pkthdr.len past mbuf data -> remote kernel heap info leak
Summary
get_next_l2cap_opt(:1317-1322) returns -3 for unknown non-hint option WITHOUT validating hdr->length vs actual mbuf data (MTU/FLUSH/QOS all validate hdr->length<=len at :1289,:1295,:1304 but default case does NOT). ng_l2cap_process_cfg_req(:599-600): m_adj(m, off-sizeof(hdr)) sets real pkthdr.len, then line :600 m->m_pkthdr.len=sizeof(hdr)+hdr.length OVERWRITES with attacker-controlled option length(up to 255). If peer sets length=0xFF but sends few real bytes -> pkthdr.len inflated to 257 when only ~6 bytes exist. Echoed mbuf in ConfigRsp -> _ng_l2cap_cfg_rsp(cmds.h:191-197) propagates inflated len -> ng_l2cap_lp_send sets on-air L2CAP+ACL length from pkthdr.len -> ng_ubt.c:1028 usbd_m_copy_in reads past mbuf chain end into adjacent kernel heap -> transmitted over Bluetooth to attacker. Trigger: L2CAP_ConfigReq with unknown non-hint option type=0x06 length=0xFF + 1 data byte -> up to ~253 bytes kernel heap leaked per request, repeatable. Remote unauth radio-range BT peer. Default config.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0508 · 11 files| File | Type | Description | Size | |
|---|---|---|---|---|
| harness.c | trigger-source | userspace harness replicating vulnerable function logic | 4.9 KB | view raw |
| build.sh | build-script | cc compile command | 89 B | view raw |
| run.sh | run-script | run the harness | 60 B | view raw |
| build.log | build-log | full compiler output | 13 B | view raw |
| run.log | run-log | full runtime output (baseline) | 885 B | view raw |
| fix_run.log | run-log | runtime output on patched kernel | 885 B | view raw |
| fix.diff | suggested-fix | git-apply-able unified diff | 1.1 KB | view raw |
| VERDICT.md | verdict | full narrative analysis | 714 B | ↓ raw |
| env.txt | environment | guest uname, cc version | 298 B | view raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-0508 VERDICT
Verdict: REPRODUCED (dead code)
Mechanism
Source: sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c:599-600,1317-1322
L2CAP ConfigReq pkthdr.len inflation.
netgraph7 is NOT compiled on DragonFlyBSD master. Source trace confirms the bug at lines 599-600 (m_pkthdr.len overwritten with attacker-controlled hdr.length) and 1317-1322 (get_next_l2cap_opt default case returns -3 without validating hdr.length). Harness demonstrates the inflation logic.
PoC changes
harness.c: replicates the vulnerable function logic demonstrating the bug.fix.diff: targeted fix for the root cause (git-apply-able).
Fix validation
See fix_status in JSON verdict and fix_build.log/fix_run.log.
Fix verification
not_testablenot_testable (netgraph7 dead code).
not_testable (netgraph7 dead code).
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- g
- r
- a
- p
- h
- 7
- /
- b
- l
- u
- e
- t
- o
- o
- t
- h
- /
- l
- 2
- c
- a
- p
- /
- n
- g
- _
- l
- 2
- c
- a
- p
- _
- e
- v
- n
- t
- .
- c
- :
- 5
- 9
- 9
- s
- y
- s
- /
- n
- e
- t
- g
- r
- a
- p
- h
- 7
- /
- b
- l
- u
- e
- t
- o
- o
- t
- h
- /
- l
- 2
- c
- a
- p
- /
- n
- g
- _
- l
- 2
- c
- a
- p
- _
- e
- v
- n
- t
- .
- c
- :
- 1
- 3
- 1
- 7
Detail
Exploit chain
none (dead code).
Evidence (decisive lines)
REPRODUCED (dead code). ng7 L2CAP ConfigReq unknown-option echo sets m->m_pkthdr.len=sizeof(hdr)+hdr.length overwriting with attacker-controlled option length. 252 bytes inflated. netgraph7 NOT compil
Verified recommended fix
Clamp newlen to m->m_pkthdr.len at :600.
Verdict
REPRODUCED (dead code). ng7 L2CAP ConfigReq unknown-option echo sets m->m_pkthdr.len=sizeof(hdr)+hdr.length overwriting with attacker-controlled option length. 252 bytes inflated. netgraph7 NOT compiled on master.
No comments yet.