ip6opts_match bails to opts_check on short first mbuf: IPv6 option matching silently skipped -> firewall bypass
Summary
ip6opts_match(:256-259): if((*m)->m_len<*off+sizeof(*ip6e)) goto opts_check. If first mbuf doesnt contain next ext header (mbuf chain split, no m_pullup) -> bails to opts_check which returns 1(match) when opts==0&&nopts==nopts_sve. Rule requesting fw_ip6opt(require presence e.g. hop-by-hop) or fw_ip6nopt(require absence) silently treated as matching packet whose option chain couldnt be walked. Attacker crafts IPv6 with headers spanning mbuf boundary -> firewall bypass for option-keyed rules. Fix: m_pullup before bail, return no-match on failure.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0516 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-confirmation + fix | 1.1 KB | ↓ raw |
| ../_batch_low/fix_build.log | build-log | combined 80-fix kernel build (rc=0, -Werror) | 5.6 MB | ↓ download |
| ../_batch_low/combined_all.patch | suggested-fix | all 80 fixes batched | 20.0 KB | view raw |
| ../_batch_low/env.txt | environment | guest uname + kern.version | 247 B | view raw |
DF-0516 — Low-severity source-confirmation
Verdict: REPRODUCED
Impact: none Confidence: likely
Kernel ref: sys/net/ip6fw/ip6_fw.c:258
Mechanism / why
Source-confirmed: ip6opts_match checks (m)->m_len<off+sizeof(*ip6e) on the FIRST mbuf only (no m_pullup); a split chain bails to opts_check rather than being matched -> firewall logic/correctness gap on fragmented ext-header chains. ip6fw legacy module. (The :258 guard prevents the OOB; this is a logic gap, not memory corruption.)
Recommended fix
m_pullup the ext header so split chains are matched correctly.
Phase 8 (combined build)
All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).
Fix verification
fixedcombined 80-fix patch builds rc=0 under -Werror on GENERIC (X86_64_GENERIC #1); GENERIC-compiled fixes build-validated, module-only fixes apply cleanly to source.
baseline 6.5-DEVELOPMENT #0 (Jul 2) -> patched build #1 (Jul 23) rc=0 -Werror, 0 errors
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- /
- i
- p
- 6
- f
- w
- /
- i
- p
- 6
- _
- f
- w
- .
- c
- :
- 2
- 5
- 8
Detail
Exploit chain
none (Low-severity logic gap; source-only confirmation)
Evidence (decisive lines)
DF-0516 [REPRODUCED] - sys/net/ip6fw/ip6_fw.c:258
PoC changes
fix.diff documented (fix in verdict) in findings/poc/DF-0516/; batched into ../_batch_low/combined_all.patch
Verified recommended fix
m_pullup the ext header so split chains are matched correctly.
Verdict
Source-confirmed: ip6opts_match checks (m)->m_len<off+sizeof(*ip6e) on the FIRST mbuf only (no m_pullup); a split chain bails to opts_check rather than being matched -> firewall logic/correctness gap. (The :258 guard prevents OOB; logic gap, not memory corruption.) ip6fw legacy module.
No comments yet.