DF-0700 — PoC evidence pack

See VERDICT.md for the full analysis (verdict, mechanism, fix, fix-validation). Reproduce: ./build.sh && ./run.sh. Machine-readable catalog: manifest.json.

DF-0700 — User-controlled edge count not bounded by MAX_EDGES → BSS OOB array write on centre_socks[]

Note on the run brief: the task brief labels DF-0700–DF-0703 as "Bluetooth BNEP." They are not — the cited file sys/net/ipfw3_basic/ip_fw3_sync.c is the ipfw3 firewall state-synchronization sub-component (nothing to do with Bluetooth). The analysis below is for the actual ipfw3_sync code.

Verdict

NOT REPRODUCED — LATENT dead code. The bug is real and unambiguous at the source level, but the vulnerable function is unreachable from userspace on this kernel because the sockopt dispatcher that would call it is never wired up (ip_fw3_ctl_sync_ptr is NULL and never assigned anywhere in the tree). This is a valid hard blocker (dead/unreachable at runtime); the fix is defense-in-depth for when the code is eventually wired up.

The bug (source-level trace)

ip_fw3_ctl_sync_centre_conf() (sys/net/ipfw3_basic/ip_fw3_sync.c:137-154) takes ioc_centre->count straight from the user sockopt value with no bounds check against MAX_EDGES (10):

ip_fw3_ctl_sync_centre_conf(struct sockopt *sopt)
{
    struct ipfw3_ioc_sync_centre *ioc_centre;
    int size;
    ioc_centre = sopt->sopt_val;
    size = ioc_centre->count * LEN_SYNC_EDGE;          /* :143 — no bound */
    ...
    fw3_sync_ctx.count = ioc_centre->count;            /* :150 — stored unvalidated */
    bcopy(ioc_centre->edges, fw3_sync_ctx.edges, ...);  /* :151 */
}

fw3_sync_ctx.count then drives array indexing over fw3_sync_ctx.centre_socks[MAX_EDGES] (ip_fw3_sync.h:77, a struct socket *[10] that is the last member of struct ipfw3_sync_context), in five places, all with for (i = 0; i < fw3_sync_ctx.count; i++) and no per-index bound:

With count > 10, centre_start writes socreate's socket-pointer result past the end of centre_socks[] — i.e. past the end of the global fw3_sync_ctx BSS symbol into whatever follows it in BSS. That is an attacker-controlled-count, fixed-stride OOB write of a kernel heap pointer (CVSS C:N/I:H/A:H). The attacker can shape count to target a specific BSS offset.

Why it is unreachable on this kernel (dead-code proof)

The whole centre_* sockopt-handler family is only callable through the dispatcher ip_fw3_ctl_sync_sockopt() (ip_fw3_sync.c:390-435). That dispatcher is itself only reachable through the function pointer ip_fw3_ctl_sync_ptr, dispatched in ip_fw3_ctl():

case IP_FW_SYNC_CENTRE_CONF:                       /* sys/net/ipfw3/ip_fw3.c:1120 */
...
case IP_FW_SYNC_CENTRE_CLEAR:                      /* :1124 */
    if (ip_fw3_ctl_sync_ptr != NULL) {             /* :1125 */
        error = ip_fw3_ctl_sync_ptr(sopt);         /* :1126 */
    }
    break;

ip_fw3_ctl_sync_ptr is initialized to NULL (ip_fw3.c:133) and is never assigned anywhere in the entire sys/ tree (grep-verified:

$ grep -rn 'ip_fw3_ctl_sync_ptr' sys/
sys/net/ipfw3/ip_fw3.c:133:  ip_fw_ctl_t *ip_fw3_ctl_sync_ptr = NULL;
sys/net/ipfw3/ip_fw3.c:1125:         if (ip_fw3_ctl_sync_ptr != NULL) {
sys/net/ipfw3/ip_fw3.c:1126:         error = ip_fw3_ctl_sync_ptr(sopt);

— only the NULL init and the NULL-check; no assignment). So the dispatch is always skipped; every IP_FW_SYNC_* sockopt is a silent no-op. centre_conf (and thus the OOB) is never called.

There is also a second layer of unreachability: the base kernel ships only the ipfw3 stub ip_fw3_glue.c (ip_fw3_sockopt returns ENOPROTOOPT until kldload ipfw3). The full ip_fw3.c (with ip_fw3_ctl) and ip_fw3_sync.c (the buggy file) live in loadable modules that are not loaded by default (kldstat | grep ipfw is empty). So even reaching the IP_FW_SYNC_* cases needs a root kldload.

Empirical confirmation (ipfw3_sync_deadpath):

setsockopt(IPPROTO_IP, IP_FW_X, {SYNC_CENTRE_CONF, count=9999}) = -1
  errno=42 (Protocol not available)          # ENOPROTOOPT — module not loaded

Issuing the sockopt that would trigger the bug returns ENOPROTOOPT on the default kernel; the SYNC_* dispatch is never entered. (And even after kldload ipfw3, ip_fw3_ctl_sync_ptr stays NULL, so the dispatch is still skipped.)

To make the bug live would require a source change assigning ip_fw3_ctl_sync_ptr = ip_fw3_ctl_sync_sockopt in the module's MOD_LOAD — not an attacker action. This is valid hard blocker (d): dead/unreachable at runtime on this guest, with no harness exercisable by an unprivileged user (a harness needs kldload, which is root → root:kernel, not unpriv→root).

Fix (defense-in-depth)

Validate ioc_centre->count against MAX_EDGES in centre_conf, so the OOB array indexing in centre_start/test/stop/send_state/MOD_UNLOAD becomes impossible whenever the code is wired up. See fix.diff:

ioc_centre = sopt->sopt_val;
if (ioc_centre->count < 0 || ioc_centre->count > MAX_EDGES)   /* +DF-0700 */
    return EINVAL;
size = ioc_centre->count * LEN_SYNC_EDGE;

The root fix is for the maintainer to decide: either wire up ip_fw3_ctl_sync_ptr (and then this bounds check is mandatory) or delete the dead sync code. Either way, this fix.diff makes the function safe.

Fix validation

• fix.diff applies cleanly to the original source (all hunks succeed).
• Compile-validated: applied alongside DF-0701/0702/0703's fixes (DF-0701 supersedes this check for the combined build), make -j6 nativekernel KERNCONF=X86_64_GENERIC → rc=0, ip_fw3_sync.c compiles into ipfw3_basic.ko with -Werror.
• fix_status: not_testable — the buggy path is dead code; the fix cannot be exercised from userspace. Validated applies + compiles + traced that it closes the unbounded-index path.

Files

Kernel references (confirmed)

• sys/net/ipfw3_basic/ip_fw3_sync.c:137-154 — ip_fw3_ctl_sync_centre_conf (no bounds check)
• sys/net/ipfw3_basic/ip_fw3_sync.c:150 — fw3_sync_ctx.count = ioc_centre->count (stored unvalidated)
• sys/net/ipfw3_basic/ip_fw3_sync.c:279-286 — centre_start OOB socreate into centre_socks[i]
• sys/net/ipfw3_basic/ip_fw3_sync.c:339-345 — centre_test OOB read of centre_socks[i]
• sys/net/ipfw3_basic/ip_fw3_sync.c:367-369 — centre_stop OOB soclose
• sys/net/ipfw3_basic/ip_fw3_sync.c:458-464 — send_state OOB so_pru_sosend
• sys/net/ipfw3_basic/ip_fw3_sync.c:487-489 — MOD_UNLOAD OOB soclose
• sys/net/ipfw3_basic/ip_fw3_sync.h:77 — centre_socks[MAX_EDGES] is last field of the struct
• sys/net/ipfw3/ip_fw3.c:133 — ip_fw3_ctl_sync_ptr = NULL (never assigned — root cause of dead path)
• sys/net/ipfw3/ip_fw3.c:1125-1126 — dead dispatch
• sys/net/ipfw3/ip_fw3_glue.c:51-62 — base-kernel stub returns ENOPROTOOPT until kldload