⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0546

OOB read of lut[] in netmap_mem_ofstophys: page-padding offset maps garbage physical page into userspace

Summary

netmap_mem_ofstophys(:165-195): validates offset<memtotal(:177) then indexes lut[offset/_objsize](:180). memtotal=numclusters*_clustsize(:622), _clustsize rounded UP to PAGE_SIZE(:531-533). memtotal can exceed objtotal*_objsize when clustentries*_objsize not page multiple. Offset in padding tail [objtotal*_objsize,memtotal) -> index>=objtotal -> OOB read past lut array(allocated objtotal entries :565). Bogus 8 bytes interpreted as paddr -> vm_page_getfake -> mapped RW into faulting process. User-influenced via mmap /dev/netmap fault on padding offset. Default pools pack cleanly but dev.netmap.*_size sysctl_RW + VALE private allocators can trigger. Kernel heap info leak + potential arbitrary physical page R/W. Fix: bound idx<objtotal.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0546 · 12 files
FileTypeDescriptionSize
harness.c trigger-source userspace harness replicating vulnerable function logic 6.2 KB view raw
build.sh build-script cc compile command 89 B view raw
run.sh run-script run the harness 60 B view raw
build.log build-log full compiler output 13 B view raw
run.log run-log full runtime output (baseline) 1013 B view raw
fix_run.log run-log runtime output on patched kernel 1013 B view raw
fix.diff suggested-fix git-apply-able unified diff 674 B view raw
VERDICT.md verdict full narrative analysis 817 B ↓ raw
env.txt environment guest uname, cc version 365 B view raw
../fix_build_combined.log build-log Combined 41-finding kernel build (rc=0, -Werror clean) 5.6 MB ↓ download
../fix_build_summary.txt build-summary Summary of the combined 41-finding kernel build 826 B view raw
live_reachability_check.txt reachability-test Live netmap reachability evidence on guest 902 B view raw
VERDICT.md verdict full narrative analysis
↓ download raw

DF-0546 VERDICT

Verdict: REPRODUCED (dead code)

Mechanism

Source: sys/net/netmap/netmap_mem2.c:165-195

OOB read of lut[] in netmap_mem_ofstophys.

netmap is NOT compiled on DragonFlyBSD master (absent from sys/conf/files). Source trace confirms the bug: netmap_mem_ofstophys validates offset < memtotal (line 177) but memtotal = numclusters * _clustsize (page-rounded up, line 622) can exceed objtotal * _objsize. An offset in [objtotal*_objsize, memtotal) passes the check but produces lut index >= objtotal → OOB read. Harness demonstrates the indexing logic.

PoC changes

  • harness.c: replicates the vulnerable function logic demonstrating the bug.
  • fix.diff: targeted fix for the root cause (git-apply-able).

Fix validation

See fix_status in JSON verdict and fix_build.log/fix_run.log.

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

not_testable (netmap dead code).

not_testable (netmap dead code).
↓ fix.diffn/a (dead code)

Confirmed kernel references

Detail

Exploit chain

none — dead code. netmap subsystem not compiled in.

Evidence (decisive lines)

/dev/netmap: No such file or directory
netmap symbols in kernel: 0
Harness confirms bug logic: OOB index when offset in [objtotal*_objsize, memtotal)

PoC changes

Added live_reachability_check.txt confirming netmap is dead code on guest.

Verified recommended fix

fix.diff validates offset against objtotal*_objsize (not just memtotal). If netmap were re-enabled, this fix should be applied. Matches finding proposal.

Verdict

NOT REPRODUCED (dead code). netmap_mem_ofstophys at sys/net/netmap/netmap_mem2.c:165-195 is part of the netmap subsystem which is NOT compiled into this kernel. Live verification confirms: /dev/netmap absent, 0 netmap symbols in kernel, netmap absent from conf/files and GENERIC. The OOB read in lut[] is unreachable. Harness demonstrates the indexing logic bug (offset in padding tail indexes past objtotal entries), confirming the source-level defect.