DF-0510 — Credential bypass via thread0 fallback in socket operations

Verdict: CODE-PATH CONFIRMED; latent from unprivileged user (root-only netgraph access)

Mechanism (confirmed at code level)

Three call sites in sys/netgraph7/ksocket/ng_ksocket.c use the identical broken expression (developer's own comment "XXX broken"):

• line 546 (ng_ksocket_newhook): td passed to socreate()
• line 661 (ng_ksocket_rcvmsg): td passed to sobind(), solisten(), soconnect(), sosend(), soreceive()
• line 886 (ng_ksocket_rcvdata): td passed to sosend()

struct thread *td = curthread->td_proc ? curthread : &thread0;  /* XXX broken */

When netgraph message processing is deferred to a kernel thread / softirq / netisr (which is normal for netgraph async dispatch), curthread->td_proc is NULL. The fallback &thread0 is the kernel's boot thread, whose td_ucred is the root credential (cr0: uid=0, all groups, all privileges).

All downstream privilege checks then evaluate against root:

• socreate(AF_INET, ..., SOCK_RAW, ...) → PRIV_NET_RAW / PRIV_NET_PRIV_SOCKET → granted (root has all caps)
• sobind() to a privileged port (<1024) → PRIV_NET_PRIV_PORT → granted
• sobind() to a jail-restricted address → jail check bypassed (root cred has no jail)
• sosend() / soreceive() → firewall / packet-filter checks evaluated as root

The v1 twin in sys/netgraph/ksocket/ng_ksocket.c (the actually loadable ng_ksocket.ko module) has the same defect at lines 559, 640, 880.

Reachability — why this is "latent from unprivileged"

ng_ksocket is driven via netgraph messages. Creating a netgraph control socket (socket(AF_NETGRAPH)) requires root:

$ ngctl list
ngctl: socket: Operation not permitted

So an unprivileged user cannot directly reach this code path. The defect matters in two realistic scenarios where the trigger runs from a privileged-but-restricted context:

1. Jail escape: a jailed root user creates a ng_ksocket. If any message processing is deferred to a kernel thread, the subsequent socket ops run with full host-root creds instead of the jail-restricted cred. The jail's IP-binding restriction is bypassed; the jailed root can sobind() to a non-jail address.
2. Capsicum sandbox escape: same pattern — a capsicum-restricted process using netgraph gets root-cred socket ops when the message is processed asynchronously.

Severity Medium is appropriate: real credential-confusion defect with a concrete sandbox-escape impact, but gated behind privileged netgraph access (so it's a priv-boundary issue within root contexts, not unpriv→root).

Fix

fix.diff replaces the &thread0 fallback with NULL and adds an explicit EPERM guard at each of the three sites:

struct thread *td = curthread->td_proc ? curthread : NULL;
...
if (td == NULL)
    return (EPERM);   /* refuse instead of escalating to root creds */

This matches the finding's recommended fix ("refuse when td_proc==NULL or store crhold at node creation"). A more complete fix would capture crhold() at node creation and reuse it; the conservative refuse fix is minimal and safe.

Build / run

ssh dfbsd-maxx 'mkdir -p poc/DF-0510'
scp findings/poc/DF-0510/{df0510.c,build.sh,run.sh} dfbsd-maxx:poc/DF-0510/
ssh dfbsd-maxx 'cd poc/DF-0510 && sh ./build.sh && sh ./run.sh'
# static code-path analysis; no live kernel trigger (defense-in-depth)