• File: sys/dev/misc/musycc/musycc.c
• Lines: 443, 449, 473, 1000, 1001, 1007, 1008
• Severity: High
• CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
• CWE: CWE-787 Out-of-bounds Write
• Confidence: certain

Summary

musycc_rcvmsg allocates a fixed-size NGM_TEXT_STATUS response of sizeof(struct ng_mesg) + NG_TEXTRESPONSE bytes (~1076 bytes of data area) but then unconditionally calls status_8370() + status_chans() into that buffer with no bounds accounting.

status_chans emits ~180–300 bytes per configured channel and iterates all NHDLC=32 slots; with five or more open hooks the writes (via repeated ksprintf(s+strlen(s),...)) blast past the end of the kmalloc'd M_NETGRAPH buffer, corrupting adjacent heap.

Root cause

In musycc_rcvmsg (sys/dev/misc/musycc/musycc.c:999-1011) the response is allocated at line 1000–1001 with NG_MKRESPONSE(*resp, msg, sizeof(struct ng_mesg) + NG_TEXTRESPONSE, M_NOWAIT).

NG_TEXTRESPONSE is 1024 (sys/netgraph/ng_message.h:59) and sizeof(struct ng_mesg)==52, so the data area at (*resp)->data has only ~1076 bytes.

s = (char *)(*resp)->data (line 1006) is then handed to status_8370(sc, s) (line 1007) and status_chans(sc, s) (line 1008).

status_chans (lines 443–474) does s += strlen(s) once and then for every non-NULL sc->chan[i] emits 7 ksprintf calls totalling ~180 bytes minimum (e.g. line 465 alone writes 'CRC %lu Dribble %lu Long %lu Short %lu Abort %lu' which is ~70 chars, and line 458 writes 'TX %lus/%lus/%lus' which can be up to ~60 chars when the channel has been alive a long time).

With u_long counters and large uptime values each channel easily produces 250+ bytes; with 5–8 hooks configured the cumulative write exceeds 1076 bytes and ksprintf silently writes off the end of the response buffer.

Hook creation is permitted on chans 1..31 (any framing) and on chan 0 with nbit==32 for E1U (musycc.c:1065-1070), so an attacker can populate many sc->chan[] slots at will before issuing the status query.

Threat

Attacker position: any credential that can open an ng_socket control connection (sys/netgraph/socket/ng_socket.c:172 requires caps_priv_check(SYSCAP_RESTRICTEDROOT)) and reach the musycc node — typically root, also any process granted that capability, and is directly useful for jail/capability-mode escape since netgraph access is the only thing required.

The musycc driver must be loaded (PCI hardware present or kldload musycc).

Impact: kernel heap memory corruption of arbitrary size (up to ~6000 bytes overwrite with 32 channels) into the M_NETGRAPH slab, with partially attacker-controlled content (channel index digits, ts bitmask in hex, fixed label strings).

Reliable kernel panic via overwrite of freed/poisoned uma memory; with heap grooming of the M_NETGRAPH zone (which holds ng_mesg, hook, node structures containing function pointers) the corruption is weaponizable to kernel code execution, escalating from root-with-netgraph to full kernel compromise.

Exploit / PoC

PoC trigger (root shell on a DragonFlyBSD system with a musycc card or module loaded):

#!/bin/sh
# musycc NGM_TEXT_STATUS heap overflow trigger
NODE='sync-0-5-0'   # adjust bus/slot/port to a real musycc node
set -x
kldload musycc 2>/dev/null || true
kldload ng_echo 2>/dev/null || true
# set unframed E1 so multiple channels may coexist
ngctl msg "$NODE:" setcfg 'line e1u' || ngctl msg "$NODE:" config 'line e1u'
# populate 8 distinct sc->chan[] slots (chan 1..8)
for n in 1 2 3 4 5 6 7 8; do
    ngctl mkpeer "$NODE:" echo "ts$n" "r$n" || \
    ngctl connect "$NODE:" echo: "ts$n" "r$n"
done
# this NGM_TEXT_STATUS overflows the ~1076-byte response buffer in musycc_rcvmsg
ngctl status "$NODE:"
dmesg | tail -40

A C trigger that builds and sends the NGM_TEXT_STATUS message directly via socket(AF_NETGRAPH, SOCK_DGRAM, NG_CONTROL) and NGM_CONNECT/NGM_MKHOOK works equivalently; either form reliably corrupts the M_NETGRAPH heap.

Success criterion: kernel panic with uma_malloc corruption trace, or — with slab grooming — controlled kernel-memory write observable via a witness object placed next to the response allocation.

Recommended fix

Bound the response writes. The minimal correct fix is to (a) size the response buffer to the worst-case output, AND (b) make status_chans()/status_8370() refuse to write past the supplied buffer.

--- a/sys/dev/misc/musycc/musycc.c
+++ b/sys/dev/misc/musycc/musycc.c
@@ -441,12 +441,15 @@ init_8370(struct softc *sc)

 static void
-status_chans(struct softc *sc, char *s)
+status_chans(struct softc *sc, char *s, size_t cap)
 {
    int i;
    struct schan *scp;
+   size_t used = strlen(s);

-   s += strlen(s);
    for (i = 0; i < NHDLC; i++) {
+       char line[256];
+       int n;
        scp = sc->chan[i];
        if (scp == NULL)
            continue;
-       ksprintf(s + strlen(s), "c%2d:", i);
-        /* ... existing ksprintf chain ... */
+       n = ksnprintf(line, sizeof(line),
+           "c%2d: ts %08x RX %lus/%lus TX %lus/%lus/%lus "
+           "TXdrop %lu Pend %lu CRC %lu Dribble %lu Long %lu "
+           "Short %lu Abort %lu\n TX: %lu RX: %lu\n",
+           i, scp->ts, time_uptime - scp->last_recv,
+           time_uptime - scp->last_rxerr, time_uptime - scp->last_xmit,
+           time_uptime - scp->last_txerr, time_uptime - scp->last_txdrop,
+           scp->tx_drop, scp->tx_pending, scp->crc_error,
+           scp->dribble_error, scp->long_error, scp->short_error,
+           scp->abort_error, scp->txn, scp->rxn);
+       if (n <= 0 || used + (size_t)n + 1 > cap) {
+           used += ksnprintf(s + used, cap - used, "...(truncated)\n");
+           break;
+       }
+       memcpy(s + used, line, n);
+       used += n;
+       s[used] = '\0';
    }
 }
@@ -1000,7 +1003,8 @@ musycc_rcvmsg(node_p node, struct ng_mesg *msg, const char *retaddr, struct ng_m
        NG_MKRESPONSE(*resp, msg,
-           sizeof(struct ng_mesg) + NG_TEXTRESPONSE, M_NOWAIT);
+           sizeof(struct ng_mesg) + NG_TEXTRESPONSE +
+           NHDLC * 256, M_NOWAIT);
        if (*resp == NULL) {
            kfree(msg, M_NETGRAPH);
            return (ENOMEM);
        }
        s = (char *)(*resp)->data;
-       status_8370(sc, s);
-       status_chans(sc,s);
+       status_8370(sc, s);
+       status_chans(sc, s, NG_TEXTRESPONSE + NHDLC * 256);

The essential correctness property is: every ksprintf/snprintf into the response buffer must be sized against a passed-in capacity, and the response allocation must be >= the worst-case sum (or the writer must truncate). Today neither holds.

Related findings

• DF-1500 (sibling): hookname[8] overrun in same file.
• DF-1501 (sibling): nchan > NPORT OOB attach in same file.
• DF-1502 (sibling): IRQ-vs-disconnect UAF in same file.