Wrong byte counter after BPF truncation: totlen -= len should be totlen = len
Summary
ng_bpf_rcvdata (:414-418): if(len<totlen){m_adj(m,-(totlen-len));totlen-=len;} m_adj trims (totlen-len) bytes so pkthdr.len==len correct. But totlen-=len makes totlen=(orig-len) = bytes stripped not new length. Corrupted totlen consumed as xmitOctets delta :429 dhip->stats.xmitOctets+=totlen. 1500B packet filter returns 30 -> xmitOctets+=1470 instead of 30. Forwarded packet correct only accounting wrong. netgraph7 fixed :486 (totlen=len) legacy never updated. No security impact totlen consumed only as u_int added to u_int64_t stat no length-driven copy. Fix: totlen=len.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0699 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Wrong byte counter after BPF truncation: totlen -= len should be totlen = len | 352 B | view raw |
Fix verification
fixedfix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netgraph/bpf/ng_bpf.c:414: wrong byte counter after BPF truncation (totlen-=len should be totlen=len)
Verified recommended fix
Source-confirmed at sys/netgraph/bpf/ng_bpf.c:414: wrong byte counter after BPF truncation (totlen-=len should be totlen=len)
Verdict
Source-confirmed at sys/netgraph/bpf/ng_bpf.c:414: wrong byte counter after BPF truncation (totlen-=len should be totlen=len)
No comments yet.