β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-0675

BPF LSH/RSH shift amount unbounded: shift-by->=32 is undefined behavior

Summary

bpf_validate (:555-576) accepts BPF_LSH/BPF_RSH with no upper bound on shift count. Interpreter: A<<=X (:443) A>>=X (:447) A<<=pc->k (:475) A>>=pc->k (:479). X settable any value via BPF_LDX|BPF_IMM or BPF_LEN; pc->k bounded only by bpf_maxbufsize 0x80000 far above 31. Shift>=32 = C UB. x86 hardware masks count to 5 bits deterministic no mem-unsafety. UBSan flags it compiler technically free to exploit. No demonstrated security impact: shifted A is pure 32-bit register used as comparison/store/return(snaplen clamped). Privileged BIOCSETF. Fix: validator reject k>=32 + interpreter mask X&31.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0675 Β· 1 files
FileTypeDescriptionSize
manifest.json file 390 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/net/bpf_filter.c:443: BPF LSH/RSH shift amount unbounded (shift-by->=32 is UB)

Verified recommended fix

Source-confirmed at sys/net/bpf_filter.c:443: BPF LSH/RSH shift amount unbounded (shift-by->=32 is UB)

Verdict

Source-confirmed at sys/net/bpf_filter.c:443: BPF LSH/RSH shift amount unbounded (shift-by->=32 is UB)