• File: sys/dev/netif/mn/if_mn.c
• Lines: 360, 298, 304, 319
• Severity: Low
• CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U:C:L/I:N/A:N
• CWE: CWE-125 Out-of-bounds Read
• Confidence: likely

Summary

In ngmn_rcvmsg the user-supplied NGM_TEXT_CONFIG argument is taken verbatim as s = (char *)msg->data (if_mn.c:360) for exactly msg->header.arglen bytes with no guarantee of NUL termination, then passed to ngmn_config where it is consumed by strcmp (298, 304), strncmp (296), strcat on the response (303, 320), and kprintf "%s" (319).

If the sender omits the terminating NUL (arglen does not include one, which the framework permits), strcmp/kprintf walk past msg->data into adjacent kernel heap until a NUL or non-matching byte is hit — an unbounded over-read of adjacent M_NETGRAPH heap.

Root cause

if_mn.c:359-362: if (msg->header.arglen) s = (char *)msg->data; else s = NULL; — the data region is exactly arglen bytes (allocated sizeof(ng_mesg)+arglen).

ngmn_config(node, s, r) then does:

• strncmp(set, "line ", 5) (296) which reads up to 5 bytes regardless of arglen,
• on the match path strcmp(set, "line e1") (298) / strcmp(set, "line e1u") (300) which read until NUL.

If arglen<5, strncmp reads past the allocation; if arglen is e.g. 6 with data "line e" (no NUL), strcmp reads byte 6, 7, ... from adjacent heap.

The unmatched-config branch also does kprintf("%s CONFIG SET [%s]\n", sc->nodename, set) (319), reading past arglen until a NUL is found in adjacent heap.

Threat

Root with netgraph access sends a crafted NGM_TEXT_CONFIG with arglen bytes and no terminating NUL.

The over-read exposes bytes of whatever kmalloc object follows the ng_mesg allocation in M_NETGRAPH — a small, noisy kernel-heap info leak back to the same root sender.

No write primitive and the leak crosses no privilege boundary (root reading kernel heap it already effectively owns), so impact is low; it is reported as a memory-safety defect, not an escalation.

Exploit / PoC

Root, mn0 node present: send NGM_TEXT_CONFIG with arglen=6 and payload bytes "line e" (no NUL).

The strcmp(set, "line e1") at if_mn.c:298 reads byte 6 onward from adjacent heap.

Observe via kprintf (if it hits the else branch at 318-321, the [%s] print dumps adjacent heap bytes to the console/dmesg).

Minimal C: open PF_NETGRAPH control socket, build ng_mesg with typecookie=NGM_GENERIC_COOKIE, cmd=NGM_TEXT_CONFIG, arglen=6, data="line e" (no NUL), sendto "mn0:".

Success = adjacent-heap bytes appear in dmesg (info leak) or no crash (confirmed OOB read tolerated).

Recommended fix

Require the text argument to be NUL-terminated within arglen before handing it to the text handlers:

--- a/sys/dev/netif/mn/if_mn.c
+++ b/sys/dev/netif/mn/if_mn.c
@@ -359,8 +359,11 @@ ngmn_rcvmsg(node_p node, struct ng_mesg *msg, const char *retaddr, struct ng_mes
    if (msg->header.arglen)
        s = (char *)msg->data;
    else
        s = NULL;
+   /* NGM_TEXT_CONFIG passes a C string; require NUL termination within arglen
+    * so strcmp()/kprintf("%s") do not walk off the user buffer. */
+   if (s != NULL && s[msg->header.arglen - 1] != '\0')
+       s = NULL;
    r = (char *)(*resp)->data;

Related findings

• DF-1539 (sibling): heap overflow in same file's NGM_TEXT_STATUS handler.
• DF-1540 (sibling): UAF read of dangling sch->hook.