DF-0610 — PoC: NGM_NAT_PROXY_RULE heap OOB read via non-NUL-terminated string

Root-capable local DoS / heap OOB read PoC.

Status

LATENT — module does not build in the current tree. sys/netinet/libalias/ is absent and m_megapullup() (referenced at ng_nat.c:692) is defined nowhere, so netgraph7_nat cannot be compiled or loaded. This PoC is source-only until libalias / m_megapullup are reintroduced.

Files

• poc.c — sends a NGM_NAT_PROXY_RULE control message whose data is filled with non-NUL bytes and whose arglen matches the sent length (≥6), forcing LibAliasProxyRule to walk the heap past the allocation looking for a NUL terminator.

Build & run (requires a buildable netgraph7_nat + libalias)

cc -o poc poc.c
# as root, on a host with a configured ng_nat node named 'nat:'
./poc

Expected outcome

Kernel panic with a faulting RIP inside LibAliasProxyRule (most likely outcome, when the walk hits an unmapped page); OR the syscall returns success and the rule is stored (latent corruption if the leaked bytes happen to parse as a valid rule).

Notes for the per-PoC verifier

• Trigger requires root (SYSCAP_RESTRICTEDROOT on ngc_attach at sys/netgraph7/socket/ng_socket.c:182-184).
• Module must be buildable first — libalias + m_megapullup must exist.
• The fix adds a kmalloc(arglen+1, …, M_ZERO) + bcopy + forced NUL before handing the string to LibAliasProxyRule; verify with git apply findings/poc/DF-0610/fix.diff.

DF-0610 — Verdict

Verdict: NOT REPRODUCED (latent — module unbuildable on this kernel)

Impact: none (the buggy code path is unreachable at runtime on the current DragonFlyBSD master tree)

Confidence: certain — confirmed by line-by-line source trace AND by runtime attempt (kldload ng_nat → "No such file or directory"; the netgraph7_nat module has no compiled artifact and cannot be built from the in-tree source).

The bug is REAL at the source level

sys/netgraph7/ng_nat.c:643-654 — the NGM_NAT_PROXY_RULE handler:

643:    case NGM_NAT_PROXY_RULE:
644:        {
645:        char *cmd = (char *)msg->data;
646:
647:        if (msg->header.arglen < 6) {
648:            error = EINVAL;
649:            break;
650:        }
651:
652:        if (LibAliasProxyRule(priv->lib, cmd) != 0)
653:            error = ENOMEM;
654:        }
655:        break;

cmd points at msg->data, which holds exactly msg->header.arglen attacker-supplied bytes with no guaranteed NUL terminator. LibAliasProxyRule() treats its argument as a C string and walks it looking for a terminating \0, so with non-NUL wire data it reads cmd[arglen] and beyond — a heap OOB read past the allocation.

The sibling handlers NGM_NAT_REDIRECT_PORT / REDIRECT_ADDR / REDIRECT_PROTO do it correctly (e.g. ng_nat.c:423-427):

bcopy(rp->description, entry->rdr.description, NG_NAT_DESC_LENGTH);
/* Safety precaution. */
entry->rdr.description[NG_NAT_DESC_LENGTH - 1] = '\0';

— bounded copy + forced NUL. The proxy-rule path omits both steps. The finding's root-cause analysis is accurate.

Why it does NOT reproduce on this kernel

The netgraph7_nat module cannot be compiled or loaded on the current DragonFlyBSD master tree. Two of its required source dependencies are absent from sys/ itself:

1. sys/netinet/libalias/ — directory does not exist. sys/conf/files:1735-1739 declares the module's libalias sources: 1735: netinet/libalias/alias.c optional netgraph7_nat 1736: netinet/libalias/alias_db.c optional netgraph7_nat 1737: netinet/libalias/alias_mod.c optional netgraph7_nat 1738: netinet/libalias/alias_proxy.c optional netgraph7_nat 1739: netalias/libalias/alias_util.c optional netgraph7_nat None of these files exist on disk (verified on both host sys/ and guest /usr/src/sys/). The module calls LibAliasInit, LibAliasProxyRule, LibAliasIn, etc. — all unresolved.

2. m_megapullup() — referenced at ng_nat.c:692, defined nowhere in sys/. grep -rn m_megapullup sys/ returns only the single reference at ng_nat.c:692; there is no definition, so the link fails.

Runtime confirmation (guest 6.5-DEVELOPMENT #0):

# kldload -n ng_nat
kldload: can't load ng_nat: No such file or directory
rc=1
# find /boot /modules /usr/obj -name 'ng_nat*'   (no output — no .ko anywhere)

The PoC (poc.c) compiles cleanly and, after kldload ng_socket, socket(AF_NETGRAPH, NG_CONTROL) succeeds — but sendto to the "nat" node fails with ENOENT because no ng_nat node can ever exist on this kernel:

sendto: No such file or directory (errno=2)
If errno=ENOENT/ENODEV the 'nat' node does not exist
(ng_nat module not loaded / not buildable on this tree).
RUN_EXIT=2

This is case (d) from the procedure: genuinely not reachable on this kernel — the sink is in a module whose source dependencies are missing from the master tree itself (not a config option an operator could flip).

This matches the DF-0611 precedent (same netgraph7_nat module, same latent classification, same not_reproduced / none verdict).

No escalation chain

The primitive is a heap OOB read, and it is latent (unreachable). There is no write primitive, no corruption, no chain to develop. Even if the module were buildable, the trigger requires root (SYSCAP_RESTRICTEDROOT on ngc_attach at sys/netgraph7/socket/ng_socket.c:182-184), so there is no privilege boundary to cross — it would be a root→kernel local DoS at best.

Fix

fix.diff applies cleanly (patch -p1 --dry-run → rc=0, hunk #1 succeeded at line 642) and closes the OOB read by giving LibAliasProxyRule() a handler-allocated, NUL-terminated copy of the wire data — matching the bounded-copy + force-NUL pattern already used by the sibling NGM_NAT_REDIRECT_* handlers:

cmd = kmalloc(msg->header.arglen + 1, M_NETGRAPH,
    M_WAITOK | M_NULLOK | M_ZERO);
if (cmd == NULL) { error = ENOMEM; break; }
bcopy(msg->data, cmd, msg->header.arglen);
cmd[msg->header.arglen] = '\0';
if (LibAliasProxyRule(priv->lib, cmd) != 0)
    error = ENOMEM;
kfree(cmd, M_NETGRAPH);

The fix uses only APIs already present and compiling in this exact file (kmalloc(...,M_NETGRAPH,M_WAITOK|M_NULLOK|M_ZERO) at lines 275/397/456/508; bcopy at 423/475/529; kfree(...,M_NETGRAPH) at 283/411/467/520).

Fix validation: not_testable

The bug did not reproduce (module unbuildable), so there is no runtime "before" marker to compare against a patched kernel. The netgraph7_nat module cannot be built even with the fix applied (the missing libalias sources and m_megapullup still block the link), so a single-fix kernel build + reboot test is impossible.

What WAS validated: - git apply --check passes on the host sys/ tree. - patch -p1 --dry-run and patch -p1 --forward both succeed on the guest /usr/src (hunk #1 at line 642). - The patched source reads correctly (bounded copy + force-NUL before the LibAliasProxyRule call, kfree after). - The fix uses only in-file APIs (no new dependencies).

fix_status = not_testable — diff applies + is syntactically consistent with the file's existing patterns; runtime test impossible because the module is unbuildable on this tree (latent).

PoC changes

• Wrote poc.c (the finding's README referenced it but it was never seeded). Self-contained C that opens an AF_NETGRAPH control socket, builds a struct ng_mesg with typecookie=NGM_NAT_COOKIE, cmd=NGM_NAT_PROXY_RULE, arglen=64 of non-NUL 'A' bytes, and sendtos it to a node named "nat". Compiles and runs on the guest; demonstrates unreachability (sendto → ENOENT, no ng_nat node).
• Wrote build.sh / run.sh repro scripts.
• Authored standalone fix.diff (git-apply-able, supersedes the finding markdown's proposal with the same logic — clean hunk against current line numbers).

Recommendation

Apply fix.diff to sys/netgraph7/ng_nat.c so the missing-validation pattern is closed whenever the module is reintroduced. Separately decide whether to resurrect sys/netinet/libalias/ + m_megapullup() or to retire netgraph7_nat from sys/conf/files. Severity Low stands as a latent code-level defect; real-world exposure today is NONE.