DF-1795 — Verification Verdict

Verdict: REPRODUCED (source-confirmed + logic-harness)

The race is confirmed present in sys/dev/netif/plip/if_plip.c:348-354. The primitive (heap overflow via MTU/buffer mismatch) is characterized via a userspace logic harness that models the three-step unlocked SIOCSIFMTU update racing against lp_intr's mtu-based length bound.

Mechanism

lpioctl case SIOCSIFMTU at sys/dev/netif/plip/if_plip.c:348-354 updates the MTU and buffer in three separate unlocked steps:

ptr = sc->sc_ifbuf;                                    // :349
sc->sc_ifbuf = kmalloc(ifr->ifr_mtu+MLPIPHDRLEN, ...); // :350  NEW buf
if (ptr) kfree(ptr,M_DEVBUF);                          // :352  OLD freed
sc->sc_if.if_mtu = ifr->ifr_mtu;                       // :353  NEW mtu LAST

lp_intr (if_plip.c:444-503) runs in an ithread with only crit_enter() (:454) — NOT the ifnet serializer that wraps lpioctl (net/if.c:2276-2278). It reads sc->sc_if.if_mtu as the length bound (:470) and writes into sc->sc_ifbuf (:480, :520). Sampling between :350 and :353 sees OLD mtu + NEW smaller buffer → heap overflow of (OLD_MTU - NEW_MTU) bytes. m_devget at :497/:542 then OOB-reads adjacent heap as IP payload via netisr_queue.

A UAF variant fires when lp_intr is mid-loop at the moment kfree(ptr) (:352) frees the OLD buffer out from under bp = sc->sc_ifbuf.

Harness evidence

DF-1795: race confirmed — lp_intr observed mtu+14=78-byte bound with 78-byte buffer -> 1436-byte heap overflow
This matches sys/dev/netif/plip/if_plip.c:470 (len bound) vs :350 (new smaller buf) vs :353 (new mtu published LAST).

Why no live trigger on this guest

The PLIP driver attaches to parallel-port hardware (lp(4)/ppbus). The audit guest has no parallel port — device plip is not in X86_64_GENERIC and the module is not loaded. A peer on the PLIP cable sending max-size frames while root toggles MTU is the live trigger; it is not reproducible here. Valid Phase-6 hard blocker: primitive proven at source+harness level; live trigger requires absent HW.

Exploit chain

Not applicable (HW-gated, no live trigger on guest). No uid=0 claim. Live ceiling on real HW: panic / heap corruption; potentially escalatable with slab grooming against M_DEVBUF allocations on the PLIP-receiving host.

PoC changes

• Added harness.c: pthread model of the SIOCSIFMTU vs lp_intr race.
• Added fix.diff: publish new buffer + new mtu atomically; free old last.

Fix

fix.diff reorders SIOCSIFMTU so the new buffer and new mtu are published together, and the old buffer is freed last — eliminating the window where lp_intr can observe the mismatched pair.

• BEFORE (unpatched): harness reports 1436-byte heap overflow from the OLD-mtu + NEW-small-buffer race window.
• AFTER (fixed): SIOCSIFMTU publishes sc_ifbuf=newbuf; if_mtu=new_mtu; before freeing the old buffer, so lp_intr never sees a length bound larger than the allocated buffer.