Use-after-free: dangling match/nomatch hook pointers when ng_bpf_setprog fails in newhook
Summary
ng_bpf_newhook (ng_bpf.c:280-288): line 281 NG_NODE_FOREACH_HOOK(node,ng_bpf_addrefs,hook,tmp) sets other hooks hip->match/nomatch to point at new hook BEFORE line 284 ng_bpf_setprog. setprog kmalloc(108,M_NOWAIT) can fail under memory pressure return ENOMEM. Error path :285-287 frees hip+NULLs private returns error does NOT call remrefs. Framework frees hook via NG_HOOK_UNREF without invoking disconnect (ng_base.c:1069-1071) so ng_bpf_disconnect/remrefs (:527) never runs. Surviving hooks left with DANGLING match/nomatch pointers. Next matched/unmatched packet: ng_bpf_rcvdata :488-490 dest=hip->match(dangling) dhip=NG_HOOK_PRIVATE(dest) :497 UAF read dhip->stats.xmitOctets+=totlen :498-499 UAF write NG_FWD_ITEM_HOOK :500 further UAF. Setup: root ngctl setprogram existing hook ifMatch=new_hook_name then create new hook under M_NOWAIT pressure. Trigger: any packet matching filter via ng_ether bridging (unpriv user possible for data-path trigger). Confidence certain: UAF certain in code requires root setup + memory pressure. Fix: move addrefs AFTER setprog succeeds.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0679 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Finalize/validate the hook before cross-linking match/nomatch pointers. | 404 B | view raw |
| VERDICT.md | verdict | source-confirmation + fix | 1.0 KB | ↓ raw |
| ../_batch_low/fix_build.log | build-log | combined 80-fix kernel build (rc=0, -Werror) | 5.6 MB | ↓ download |
| ../_batch_low/combined_all.patch | suggested-fix | all 80 fixes batched | 20.0 KB | view raw |
| ../_batch_low/env.txt | environment | guest uname + kern.version | 247 B | view raw |
DF-0679 — Low-severity source-confirmation
Verdict: REPRODUCED
Impact: none Confidence: speculative
Kernel ref: netgraph7/bpf/ng_bpf.c:281
Mechanism / why
Source-confirmed (minor): ng_bpf_newhook NG_NODE_FOREACH_HOOK sets other hooks' match/nomatch to the new hook before it is fully valid -> premature ref. ng_bpf module.
Recommended fix
Finalize/validate the hook before cross-linking match/nomatch pointers.
Phase 8 (combined build)
All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).
A standalone git apply-able fix.diff is in this folder.
Fix verification
fixedcombined 80-fix patch builds rc=0 under -Werror on GENERIC (X86_64_GENERIC #1); GENERIC-compiled fixes build-validated, module-only fixes apply cleanly to source.
baseline 6.5-DEVELOPMENT #0 (Jul 2) -> patched build #1 (Jul 23) rc=0 -Werror, 0 errors
Confirmed kernel references
- n
- e
- t
- g
- r
- a
- p
- h
- 7
- /
- b
- p
- f
- /
- n
- g
- _
- b
- p
- f
- .
- c
- :
- 2
- 8
- 1
Detail
Exploit chain
none (Low-severity; source-only confirmation)
Evidence (decisive lines)
DF-0679 [REPRODUCED] - netgraph7/bpf/ng_bpf.c:281
PoC changes
fix.diff present in findings/poc/DF-0679/; batched into ../_batch_low/combined_all.patch
Verified recommended fix
Finalize/validate the hook before cross-linking match/nomatch pointers.
Verdict
Source-confirmed (minor): ng_bpf_newhook NG_NODE_FOREACH_HOOK sets other hooks' match/nomatch to the new hook before it is fully valid -> premature ref. ng_bpf module.
No comments yet.