DF-0739 — ip_fw3_ctl_set_get heap over-read / kernel memory disclosure

Severity: Medium (info leak) · Status: REPRODUCED, FIX VALIDATED Cited bug: sys/net/ipfw3/ip_fw3_set.c:213 — bcopy(&ctx->sets, sopt->sopt_val, sopt->sopt_valsize) with no bounds check; ctx->sets is a 4-byte uint32_t, the LAST field of struct ipfw3_context.

Build

./build.sh      # cc -O2 -o df0739 df0739.c

Run (root only — see reachability)

./run.sh [readlen]      # default 256; tries readlen up to 65536

run.sh sets net.filters_default_to_accept=1 and kldload ipfw3 first (idempotent), so loading the firewall does not cut off ssh.

Expected

Bug present (unpatched #0 ipfw3.ko, sha256 ca6ccfb9…)

getsockopt returned <readlen> bytes (requested <readlen+4> payload after 4-byte x_header)
Over-read past ctx->sets: <readlen-4> bytes (heap residue):
  ...kernel pointers (0xffff...) and adjacent-slab strings (getty/ttyv*/csh/...)...
candidate 64-bit kernel pointers (0xffff...): N>0

A 128-byte request leaks ~124 bytes of heap incl. up to 12 kernel pointers; a 1024-byte request leaks 1020 bytes.

Fixed (patched ipfw3.ko, sha256 241f263a…)

getsockopt returned 4 bytes (requested <readlen+4> payload after 4-byte x_header)
ctx->sets (first 4 bytes, the only legitimate field): ...
len <= 4: no over-read observed

Exactly the 4 valid bytes of ctx->sets; zero heap residue.

Reachability

• ipfw3.ko must be loaded (kldload ipfw3, root).
• IP_FW_X is handled only by rip_ctloutput (sys/netinet/raw_ip.c), reachable solely via SOCK_RAW, which needs SYSCAP_NONET_RAW (root).
• An unprivileged user (maxx) gets EPERM on socket(SOCK_RAW,…) and ENOPROTOOPT on IP_FW_X over SOCK_DGRAM.

=> This is a root-reachable heap info leak, not an unpriv→root escalation.

Fix

fix.diff clamps the copy to sizeof(ctx->sets) (4 bytes) and sets sopt_valsize so the copyout returns only those 4 bytes. Validated on a rebuilt ipfw3.ko (module-scoped single-file fix; no kernel rebuild needed).

DF-0739 — ip_fw3_ctl_set_get heap over-read / kernel memory disclosure

Verdict: REPRODUCED (root-reachable heap over-read / kernel pointer + string leak). FIX VALIDATED.

The bug

sys/net/ipfw3/ip_fw3_set.c:206-215

int
ip_fw3_ctl_set_get(struct sockopt *sopt)
{
        struct ipfw3_context *ctx;

        ctx = fw3_ctx[mycpuid];

        bcopy(&ctx->sets, sopt->sopt_val, sopt->sopt_valsize);   /* <-- BUG */
        return 0;
}

ctx->sets is a single uint32_t and is the LAST field of struct ipfw3_context (sys/net/ipfw3/ip_fw3.h:482-490):

struct ipfw3_context {
        struct ip_fw                  *rules;
        struct ip_fw                  *default_rule;
        struct ipfw3_state_context    *state_ctx;
        struct ipfw3_table_context    *table_ctx;
        uint32_t                       sets;     /* offset 32; struct ends at 36 */
};

sopt->sopt_valsize is attacker-controlled (capped at SOMAXOPT_SIZE = 65536 for non-root, SOMAXOPT_SIZE0 = 32 MiB for root — sys/kern/uipc_syscalls.c:1319-1330, sys/sys/socket.h:356-357). Any valsize > 4 makes the bcopy read past the fw3_ctx[cpu] allocation into adjacent kernel heap, and those bytes are returned verbatim to userspace by sys_getsockopt's copyout(sopt->sopt_val, uap->val, sopt->sopt_valsize) (sys/kern/uipc_syscalls.c:1349).

There is no bounds check anywhere on this path — confirmed by reading ip_fw3_ctl_set_get, ip_fw3_ctl_set_sockopt, ip_fw3_ctl, ip_fw3_ctl_x, ip_fw3_sockopt, and rip_ctloutput.

Trigger path (reachability)

1. ipfw3.ko must be loaded (kldload ipfw3 — root-only). This is the acceptable operational precondition (a firewall admin loads ipfw3).
2. The IP_FW_X (=49, sys/netinet/in.h:389) socket option is handled only by rip_ctloutput (sys/netinet/raw_ip.c:334 GET / :385 SET), which is the pr_ctloutput for every SOCK_RAW inet protocol (sys/netinet/in_proto.c — all rip_ctloutput entries are SOCK_RAW).
3. Creating a raw IP socket requires caps_priv_check(SYSCAP_NONET_RAW) (sys/netinet/raw_ip.c:473), i.e. root. Confirmed empirically: maxx (uid 1001) gets EPERM on socket(AF_INET, SOCK_RAW, …), and a SOCK_DGRAM socket gets ENOPROTOOPT (errno 42) on IP_FW_X.

=> The live trigger is root-reachable. This is a root→kernel heap information leak. It is not an unprivileged→kernel escalation. The realistic impact ceiling is: a process holding SYSCAP_NONET_RAW (or uid 0) on a host where ipfw3 is loaded can disclose up to 64 KiB (32 MiB for root) of kernel heap per call, including kernel pointers and the contents of adjacent slab objects — bypassing any securelevel >0 kernel-memory read restriction. With sufficient calls / heap grooming this is a KASLR-defeat and a building block for further exploitation. No memory-corruption primitive is obtained, so no uid=0 escalation chain is derivable from this finding alone.

Data flow (getsockopt)

user: getsockopt(s, IPPROTO_IP, IP_FW_X=49, buf[=x_header{opcode=IP_FW_SET_GET=95}+room], &len)
sys_getsockopt                      sys/kern/uipc_syscalls.c:1303
  sopt.sopt_valsize = len           (1319)  capped SOMAXOPT_SIZE[0]
  sopt.sopt_val = kmalloc(len,M_TEMP)        (1332)
  copyin(uap->val, sopt.sopt_val, len)       (1336)
  kern_getsockopt -> sogetopt -> rip_ctloutput
rip_ctloutput  case IP_FW_X (SOPT_GET)       sys/netinet/raw_ip.c:334
  -> ip_fw3_sockopt                          sys/net/ipfw3/ip_fw3_glue.c:51
     -> ip_fw_ctl_x_ptr = ip_fw3_ctl_x       sys/net/ipfw3/ip_fw3.c:1038
        sopt_valsize -= sizeof(ip_fw_x_header) /*4*/   (1044)
        bcopy(++x_header, sopt_val, sopt_valsize)      (1045)  /* shift past hdr */
        sopt_name = IP_FW_SET_GET                      (1043)
        -> ip_fw3_ctl case IP_FW_SET_GET               (1070)
           -> ip_fw3_ctl_set_sockopt                   (256)
              -> ip_fw3_ctl_set_get(sopt)              (206)
                 bcopy(&ctx->sets, sopt_val, sopt_valsize)  *** OVER-READ ***
  copyout(sopt_val, uap->val, sopt_valsize)            (1349)  *** LEAK TO USER ***

Reproduction (observed on the unpatched #0 kernel)

./df0739 128 (root, ipfw3 loaded):

getsockopt returned 128 bytes (requested 132 payload after 4-byte x_header)
ctx->sets (first 4 bytes, the only legitimate field):
  0000: 00 00 00 00
Over-read past ctx->sets: 124 bytes (heap residue):
  0000: 00 00 00 00 00 00 00 00 00 00 00 00 80 26 0a 4f
  0010: 00 f8 ff ff 30 09 60 82 ff ff ff ff 00 00 00 00
  0030: 00 00 00 00 20 21 0a 4f 00 f8 ff ff 20 0b 60 82
  0040: ff ff ff ff 00 00 00 00 00 00 00 00 02 00 00 00
  ...
non-zero bytes in over-read region: 60 / 124
candidate 64-bit kernel pointers (0xffff...): 12

Decoded leaked 64-bit kernel pointers include 0xffffff80_4f0a2680, 0xffffff82_82600930, 0xffffff80_4f0a2120, 0xffffff82_82600b20 — genuine KVA addresses. Across runs the over-read also disclosed the contents of adjacent slab objects holding process/path strings: csh, -c, /usr/libexec/sftp-server, /usr/libexec/getty, ttyv0, ttyv3, ttyv5. The leak content varies with slab layout (different bytes across reset/reload), confirming it is live kernel heap, not a fixed buffer.

Unprivileged reachability (maxx, uid 1001) — confirmed not reachable:

socket(SOCK_RAW) failed: Operation not permitted (need SYSCAP_NONET_RAW / root)
DGRAM getsockopt(IP_FW_X) rc=-1 errno=42 Protocol not available

Exploit chain

None — this is a pure heap over-read / information disclosure, not a write/corruption primitive. No uid=0 escalation is derivable. Impact ceiling: kernel heap pointer + string disclosure (KASLR-defeat / securelevel read-bypass building block), up to 64 KiB per call (non-root raw) / 32 MiB (root). The leak is read-only; the realistic worst case is information disclosure that aids a separate write-class bug.

Fix (fix.diff — VALIDATED)

Clamp the copy to the 4 valid bytes of ctx->sets and set sopt_valsize accordingly so copyout only returns those 4 bytes:

 if (sopt->sopt_valsize < sizeof(ctx->sets))
         return (EINVAL);
 sopt->sopt_valsize = sizeof(ctx->sets);
 bcopy(&ctx->sets, sopt->sopt_val, sizeof(ctx->sets));

This matches the finding proposal (bound the bcopy to sizeof(uint32_t)).

Phase 8 — fix validation (module-scoped, single file in ipfw3.ko)

The fix lives entirely in sys/net/ipfw3/ip_fw3_set.c, which compiles into the loadable ipfw3.ko (not the base kernel). So a single-module rebuild + reload is the correct validation, faster than a full kernel rebuild.

• Baseline (/boot/kernel/ipfw3.ko sha256 ca6ccfb9…, unpatched #0 kernel 6.5-DEVELOPMENT): ./df0739 128 returns 128 bytes — 124-byte heap over-read with 12 kernel pointers + adjacent-slab strings. ./df0739 1024 returns 1024 bytes — 1020-byte over-read. (run.log, leak_sample.txt)
• Applied fix.diff to /usr/src/sys/net/ipfw3/ip_fw3_set.c (patch -p1 → Hunk #1 succeeded at 210).
• Built the module: cd /usr/src/sys/net/ipfw3 && make obj && make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC → rc=0 (fix_build.log).
• Installed: cp /usr/obj/usr/src/sys/net/ipfw3/ipfw3.ko /boot/kernel/ipfw3.ko (sha256 241f263a…). kldload ipfw3 loads the fixed module.
• Patched re-run: ./df0739 128 and ./df0739 1024 both return exactly 4 bytes (ctx->sets), len <= 4: no over-read observed, deterministically across 4 runs. (fix_run.log)

Result: fixed. The over-read is gone on the patched module and present on the unpatched baseline — clean before/after.

PoC changes

The finding's poc_path was registered but the folder/markdown were not yet materialized on disk, so the trigger PoC (df0739.c), build.sh, run.sh, fix.diff, and all logs were authored fresh by this verification run. The PoC exercises the exact cited path: getsockopt(IPPROTO_IP, IP_FW_X=49) with an ip_fw_x_header{opcode=IP_FW_SET_GET=95} and an oversized valsize, hex-dumps the over-read region, and counts leaked kernel pointers.

Notes

• ipfw3 is loaded by default with default to deny, which cuts ssh off the moment it loads. The run.sh sets net.filters_default_to_accept=1 first so the firewall allows ssh while the module is loaded. This sysctl is read by ipfw3 at load time (sys/net/ipfw3/ip_fw3.c:1425).
• Reachability for an unprivileged user was specifically tested and denied (SYSCAP_NONET_RAW required). Honest impact: root-reachable heap info leak, not unpriv→root. The Medium severity in the finding is appropriate for an info-leak / KASLR-defeat building block reachable once ipfw3 is loaded.