DF-0802 — Panic on malformed BOOTP/DHCP options from unauthenticated network reply during diskless boot

Verdict

REPRODUCED (code-level harness) — pre-auth remote DoS via kernel panic(). Impact: panic / DoS (no write primitive, no escalation path). Fix: VALIDATED — fix.diff applies cleanly, compiles in a BOOTP kernel build (rc=0, -Werror), and the harness before/after shows 6/6 → 0/6 panics.

The bug

sys/vfs/nfs/bootp_subr.c :: bootpc_decode_reply() contains six panic() calls (lines 1390/1404/1435/1464/1474/1481) that fire on attacker-controlled DHCP/BOOTP option values received from an unauthenticated network reply. Each is reachable from a single forged BOOTP/DHCP packet:

Call path (network → panic)

1. During diskless boot, bootpc_init() → bootpc_call() broadcasts a BOOTP/DHCP request. At bootp_subr.c:807, the reply is received via: c error = soreceive(so, NULL, &auio, NULL, NULL, &rcvflg); The second argument is NULL — the source address is never captured, so there is no source-IP filtering: any host on the L2 segment that sees the broadcast request (xid/hlen/chaddr are all visible in it) can forge a reply.
2. The reply is validated only for minimum length (:826, BOOTP_MIN_LEN=300) and cookie (bootpc_hascookie, :1256).
3. bootpc_decode_reply() (:1341) then calls bootpc_tag() (:1307) → bootpc_tag_helper() (:1264) to parse the option TLVs. The parser itself is safe — it bounds-checks TLV lengths at :1283 (if (j >= ej || j + *j + 1 > ej) badopt=1). So the option is well-formed in structure; it is the semantic value (wrong length for the tag, or a non-IP-path string) that triggers panic().
4. bootpc_decode_reply() hits one of the six panic() sites.

Each variant is a single forged packet = deterministic kernel panic.

Reachability (important caveat)

bootp_subr.c is optional bootp in sys/conf/files:1894 and is NOT compiled into the default X86_64_GENERIC kernel (which has only options NFS_ROOT). It is only built with options BOOTP (present in LINT64, or a custom diskless-boot config). Its sole live trigger is the early-boot diskless path (nfs_boot → bootpc_init), which cannot be staged on this guest (it boots from vtblk0, not NFS root, and the code is absent from the running kernel).

For these reasons the reproduction is a deterministic code-level harness (bootp_panic_harness.c) that copies the kernel's parser functions verbatim (bootpc_hascookie, bootpc_tag_helper, bootpc_tag, bootpc_decode_reply, setfs, getdec) and feeds them crafted BOOTP packets with malformed options. panic() is defined as fprintf(stderr,...) + abort() to faithfully model the kernel's halt.

Reproduction result

$ ./bootp_panic_harness
[1] V1 TAG_SUBNETMASK len=3          : PANIC (kernel would halt)
[2] V2 TAG_ROUTERS len=5             : PANIC (kernel would halt)
[3] V3 TAG_ROOT bad-host             : PANIC (kernel would halt)
[4] V4 TAG_SWAP bad-host             : PANIC (kernel would halt)
[5] V5 TAG_SWAPSIZE len=3            : PANIC (kernel would halt)
[6] V6 TAG_HOSTNAME len=256          : PANIC (kernel would halt)
6/6 malformed options cause kernel panic() in bootpc_decode_reply.

All 6 panic sites fire. Each is an unauthenticated one-packet DoS.

Escalation

None. The primitive is a kernel panic (read-and-compare of attacker-supplied option length/value, then panic()). There is no memory write, no corruption of adjacent memory — the option parser bounds-checks TLV lengths before any bcopy, so the panic fires before any data is written. The impact ceiling is a pre-auth remote DoS (prevents the system from booting). No uid=0 chain is derivable.

Fix (fix.diff)

Replace each of the 6 panic() calls with kprintf() + skip-the-option (graceful degradation, matching how a network client should handle malformed server input). The diff restructures each site into an if/else so that the malformed option is logged and skipped while valid options continue to be processed.

Fix validation

1. git apply --check: clean (rc=0).
2. Kernel compilation: applied fix.diff to /usr/src, added options BOOTP + options BOOTP_NFSROOT to X86_64_GENERIC, ran make -j6 nativekernel KERNCONF=X86_64_GENERIC. The fixed bootp_subr.c compiled with -Werror (zero warnings/errors); bootp_subr.o produced (275 KB); full kernel build completed rc=0.
3. Harness before/after (faithful code-level analog of kernel before/after): - Before (unpatched logic): 6/6 malformed options → panic. - After (fixed logic, same transformation as fix.diff): 0/6 → all gracefully skipped with a warning.
4. Live-kernel trigger: not_testable — the bootpc_decode_reply runtime path (diskless boot) cannot be exercised on this guest; the fix is validated at the compilation + faithful-logic level.

Files