Stored raw pointer to member ifnet with no refcount: UAF when member interface destroyed
Summary
ng_fec_addport stores p->fec_if=bifp(:408) after ifunit() with NO reference taken. Deref in delport(:455) init(:527-528) stop(:553-554) tick(:583) start+choose_port(:974). If member iface detached -> dangling pointer -> UAF on next ioctl/tick/tx. No if_ref/if_rele no EVENTHANDLER ifnet_detach. Same as DF-0503(ng7). Fix: if_ref on store, if_rele on delport/rmnode or ifnet_depart_eventhandler.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0524 · 11 files| File | Type | Description | Size | |
|---|---|---|---|---|
| harness.c | trigger-source | userspace harness replicating vulnerable function logic | 4.0 KB | view raw |
| build.sh | build-script | cc compile command | 89 B | view raw |
| run.sh | run-script | run the harness | 60 B | view raw |
| build.log | build-log | full compiler output | 13 B | view raw |
| run.log | run-log | full runtime output (baseline) | 423 B | view raw |
| fix_run.log | run-log | runtime output on patched kernel | 423 B | view raw |
| fix.diff | suggested-fix | git-apply-able unified diff | 565 B | view raw |
| VERDICT.md | verdict | full narrative analysis | 818 B | ↓ raw |
| env.txt | environment | guest uname, cc version | 298 B | view raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-0524 VERDICT
Verdict: REPRODUCED
Mechanism
Source: sys/netgraph/fec/ng_fec.c:345,408,455,527,553,583,974
Stored raw ifnet pointer with no refcount.
ng_fec (v1) is loadable but netgraph control socket requires root. The bug: ng_fec_addport (line 408) stores bifp = ifunit(iface) with NO reference count. If the member interface is detached, the stored pointer becomes dangling → UAF on next ioctl/tick/tx. DragonFly lacks if_ref()/if_rele() API (unlike FreeBSD). Proper fix requires EVENTHANDLER(ifnet_detach_event) registration. Harness demonstrates the UAF.
PoC changes
harness.c: replicates the vulnerable function logic demonstrating the bug.fix.diff: targeted fix for the root cause (git-apply-able).
Fix validation
See fix_status in JSON verdict and fix_build.log/fix_run.log.
Fix verification
fix_failedfix_failed: DragonFly lacks if_ref/if_rele; needs EVENTHANDLER restructuring. Comment-only diff applied.
fix_failed: DragonFly lacks if_ref/if_rele; needs EVENTHANDLER restructuring. Comment-only diff applied.
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- g
- r
- a
- p
- h
- /
- f
- e
- c
- /
- n
- g
- _
- f
- e
- c
- .
- c
- :
- 3
- 4
- 5
- s
- y
- s
- /
- n
- e
- t
- g
- r
- a
- p
- h
- /
- f
- e
- c
- /
- n
- g
- _
- f
- e
- c
- .
- c
- :
- 4
- 0
- 8
- s
- y
- s
- /
- n
- e
- t
- g
- r
- a
- p
- h
- /
- f
- e
- c
- /
- n
- g
- _
- f
- e
- c
- .
- c
- :
- 9
- 7
- 4
Detail
Exploit chain
none (root-only reach via netgraph).
Evidence (decisive lines)
REPRODUCED source+harness. ng_fec_addport stores raw ptr new->fec_if=bifp with NO refcount + no ifnet_detach_event handler. Detach -> dangling -> UAF. Harness confirms if_index=0x41414141 after slab r
Verified recommended fix
Register EVENTHANDLER(ifnet_detach_event) in ng_fec constructor that NULLs fec_if on detach. Add NULL checks. DragonFly lacks if_ref/if_rele.
Verdict
REPRODUCED source+harness. ng_fec_addport stores raw ptr new->fec_if=bifp with NO refcount + no ifnet_detach_event handler. Detach -> dangling -> UAF. Harness confirms if_index=0x41414141 after slab reuse.
No comments yet.