REJECT_RST copies full 20-byte tcphdr after PULLUP_TO guaranteed only 14: stale mbuf buffer leak in RST
Summary
TCP rule-match: PULLUP_TO(off+14)(:629) guarantees m_len>=off+14 (sport/dport/seq/ack/off_flags) NOT th_win/th_sum/th_urp. REJECT_RST(:773-816) sets tcp=(tcphdr*)(ip6+off)(:775), ti.th=*tcp(:788) copies sizeof(tcphdr)=20 bytes. Bytes [off+14,off+20) not guaranteed in m_len -> stale/leftover buffer content. Flows into RST via bcopy+tcp_respond(:812-813). Remote info leak ~4 bytes (th_win,th_urp) stale mbuf content per matched packet. Requires REJECT_RST rule + adversarial mbuf split. Fix: PULLUP_TO(off+sizeof(tcphdr)).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0514 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-confirmation + fix | 1.1 KB | ↓ raw |
| ../_batch_low/fix_build.log | build-log | combined 80-fix kernel build (rc=0, -Werror) | 5.6 MB | ↓ download |
| ../_batch_low/combined_all.patch | suggested-fix | all 80 fixes batched | 20.0 KB | view raw |
| ../_batch_low/env.txt | environment | guest uname + kern.version | 247 B | view raw |
DF-0514 — Low-severity source-confirmation
Verdict: NOT_REPRODUCED
Impact: none Confidence: certain
Kernel ref: sys/net/ipfw/ip_fw2.c:3323
Mechanism / why
FALSE POSITIVE: the TCP-match path does PULLUP_TO(hlen + sizeof(struct tcphdr)) (full 20-byte header) before any th_flags/th_ack/th_win reads (ip_fw2.c:3323,3932); th_win/th_sum/th_urp ARE covered. The cited :629/:773 line numbers do not match current master.
Recommended fix
No code change needed: false positive (full tcphdr pulled before th_* reads).
Phase 8 (combined build)
All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- /
- i
- p
- f
- w
- /
- i
- p
- _
- f
- w
- 2
- .
- c
- :
- 3
- 3
- 2
- 3
Detail
Exploit chain
none (false positive)
Evidence (decisive lines)
DF-0514 [NOT_REPRODUCED] - sys/net/ipfw/ip_fw2.c:3323
PoC changes
no code change (false positive) in findings/poc/DF-0514/
Verified recommended fix
No code change needed: false positive (full tcphdr pulled before th_* reads).
Verdict
FALSE POSITIVE: the TCP-match path does PULLUP_TO(hlen + sizeof(struct tcphdr)) (full 20-byte header) before any th_flags/th_ack/th_win reads (ip_fw2.c:3323,3932); th_win/th_sum/th_urp ARE covered. The cited :629/:773 line numbers do not match current master.
No comments yet.