DF-0522 — VERDICT

Verdict: SOURCE-CONFIRMED (3 "XXX broken" sites); NOT DIRECTLY TRIGGERABLE in a simple PoC; root-only reachability

The bug (confirmed in source)

ng_ksocket uses an acknowledged-broken credential fallback at three call sites:

// sys/netgraph/ksocket/ng_ksocket.c:559  (ng_ksocket_newhook -> socreate/sobind)
// sys/netgraph/ksocket/ng_ksocket.c:640  (ng_ksocket_rcvmsg  -> soconnect/sogetopt/...)
// sys/netgraph/ksocket/ng_ksocket.c:880  (ng_ksocket_rcvdata  -> sosend)
struct thread *td = curthread->td_proc ? curthread : &thread0;   /* XXX broken */

When a ksocket operation runs in a context where curthread->td_proc == NULL (i.e. a kernel thread / softinterrupt / asynchronous netgraph dispatch — no owning user process), the code falls back to &thread0, which carries root credentials. The td is then passed to socreate (:598), sobind (:662), solisten (:674), soconnect (:726), sosend (:912). Consequently the privilege checks evaluated inside those socket operations — PRIV_NET_RAW, PRIV_NET_PRIV_PORT (bind < 1024), and jail restrictions — are all evaluated against root, not the real (or absent) credential. The developer's own /* XXX broken */ comment concedes the defect. This is the same defect as the netgraph7 twin DF-0510.

Why it is not directly triggerable in a simple PoC

The fallback fires only when curthread->td_proc == NULL — i.e. when the netgraph hook/data operation is serviced by a kernel worker thread rather than synchronously in the issuer's syscall context. A synchronous ngctl control message issued by root runs in root's own process context (curthread->td_proc != NULL), so the fallback branch is NOT taken and root's own (legitimate) credential is used. Verified: ng_ksocket node creation succeeds without panic (ngctl mkpeer .: ksocket ... → RC=0, no crash), unlike ng_fec.

Forcing the async-dispatch context where td_proc == NULL requires constructing a netgraph topology whose hook/data callbacks are queued to a netgraph worker thread rather than executed inline — impractical for a standalone PoC. The defect is therefore confirmed at the source level (the broken pattern and the XXX broken acknowledgement are unambiguous), not by a runtime privilege escalation.

Reachability / privilege model

Netgraph node creation requires the ng_socket control socket, gated by caps_priv_check(SYSCAP_RESTRICTEDROOT) (sys/netgraph/socket/ng_socket.c:172) — root only. Verified: unprivileged maxx gets EPERM. So even if the fallback fired, the ksocket node was created by root; the realistic impact ceiling is a jail privilege-bypass: a root-configured ksocket node inside a jail, whose hook ops are serviced by a kernel worker thread, would have its PRIV_NET_RAW / bind-<1024 / jail checks evaluated against host-root (thread0) instead of the jail credential — a jail privilege-boundary confusion.

Impact ceiling

Medium logic / privilege-confusion defect: socket privilege checks (PRIV_NET_RAW, privileged-port bind, jail) evaluated against root when ksocket ops run in kernel-dispatch context. Not a memory-corruption primitive; no uid=0 chain.

Exploit chain

none — logic/privilege bug, not memory corruption.

Fix validation

fix.diff replaces the &thread0 fallback with fail-closed at all three sites: if curthread->td_proc == NULL, return EACCES instead of granting root credentials. Compiles cleanly (RC=0, ng_ksocket.ko produced; all 3 sites patched). fix_status = not_testable — the fallback only fires under async dispatch, which a synchronous PoC cannot force; compile-validated only.

(An alternative, more complete fix would capture the creating user's credential at node/hook creation time and use that stored credential in rcvmsg/rcvdata — matching the finding's "capture credential at node creation" recommendation. The fail-closed fix is the minimal safe version.)

PoC changes

Wrote trigger.sh (loads ng_ksocket, documents the 3 broken sites), build.sh/ run.sh, fix.diff (fail-closed at all 3 sites). No upstream PoC.