NULL-deref panic in NGM_NETFLOW_INFO and NGM_NETFLOW_IFINFO response allocation
Summary
LATENT: module cannot link (DF-0647). INFO (:305-308) and IFINFO (:328-331) handlers call NG_MKRESPONSE with M_WAITOK|M_NULLOK (can return NULL under VM pressure) then immediately deref resp->data with NO NULL guard. SHOW handler (:409-412) correctly checks if(!resp)ERROUT(ENOMEM). M_WAITOK|M_NULLOK can still return NULL (M_NULLOK documents ok to return NULL). When NULL -> kernel faults dereferencing NULL+offset_of(ng_mesg,data) -> panic. Requires CAP_NETGRAPH control socket (root) to send NGM_NETFLOW_COOKIE messages. Latent until netflow.c ported.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0648 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-confirmation + fix | 1012 B | ↓ raw |
| ../_batch_low/fix_build.log | build-log | combined 80-fix kernel build (rc=0, -Werror) | 5.6 MB | ↓ download |
| ../_batch_low/combined_all.patch | suggested-fix | all 80 fixes batched | 20.0 KB | view raw |
| ../_batch_low/env.txt | environment | guest uname + kern.version | 247 B | view raw |
DF-0648 — Low-severity source-confirmation
Verdict: INCONCLUSIVE
Impact: panic Confidence: likely
Kernel ref: netgraph7/netflow/ng_netflow.c:305
Mechanism / why
LATENT: module cannot link (DF-0647); INFO/IFINFO handlers call NG_MKRESPONSE M_WAITOK|M_NULLOK and deref the result without a NULL check. Source-confirmed defect in a non-linking module.
Recommended fix
NULL-check the NG_MKRESPONSE result before dereferencing.
Phase 8 (combined build)
All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).
Confirmed kernel references
- n
- e
- t
- g
- r
- a
- p
- h
- 7
- /
- n
- e
- t
- f
- l
- o
- w
- /
- n
- g
- _
- n
- e
- t
- f
- l
- o
- w
- .
- c
- :
- 3
- 0
- 5
Detail
Exploit chain
none (latent; source-confirmed)
Evidence (decisive lines)
DF-0648 [INCONCLUSIVE] - netgraph7/netflow/ng_netflow.c:305
PoC changes
fix.diff documented (fix in verdict) in findings/poc/DF-0648/; batched into ../_batch_low/combined_all.patch
Verified recommended fix
NULL-check the NG_MKRESPONSE result before dereferencing.
Verdict
LATENT: module cannot link (DF-0647); INFO/IFINFO handlers call NG_MKRESPONSE M_WAITOK|M_NULLOK and deref the result without a NULL check. Source-confirmed defect in a non-linking module.
No comments yet.