⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2365

Decrypted but unauthenticated plaintext written back to mbuf before tag check

Summary

In _chacha20poly1305_mbuf decryption path decrypts final block into local buffer then unconditionally writes decrypted block back into mbuf with m_copyback before and regardless of whether _final returned false (tag mismatch EBADMSG). Same applies to every block earlier in loop. On auth failure mbuf left containing attacker-influenced decrypted data. WireGuard caller drops on EBADMSG so no current leak but AEAD contract plaintext never released on MAC failure violated at library layer. [VERIFIED pass2: source-confirmed - tail m_copyback writes unauthenticated plaintext before tag verdict; hygiene only wg frees on EBADMSG; ret-gate fix]

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2365 · 8 files
FileTypeDescriptionSize
VERDICT.md — 1.7 KB ↓ raw
README.md — 230 B ↓ raw
build.sh — 85 B view raw
run.sh — 49 B view raw
env.txt — 314 B view raw
manifest.json — 631 B view raw
verdict.json — 2.2 KB view raw
fix.diff — 489 B view raw
README.md
↓ download raw

DF-2365 evidence pack

  • finding: sys/crypto/chachapoly.c (344-356)
  • verdict: reproduced (certain) - see VERDICT.md
  • source-only confirmation (no runtime PoC)
  • reproduce: build.sh / run.sh
  • fix.diff: present, git-apply-able
VERDICT.md
↓ download raw

DF-2365 - Verification Verdict

Status: reproduced Impact: none (hardening) Confidence: certain

Mechanism

In _chacha20poly1305_mbuf decryption the final partial block is decrypted into the local block by _chacha20poly1305_final (line 351-352) and then written back into the mbuf by m_copyback (line 354) UNCONDITIONALLY - before the tag comparison result is even returned; the whole stream is likewise decrypted in place during the update loop.

Verdict

source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Only in-tree caller is wg_noise.c:1027 (WireGuard), which frees the mbuf on EBADMSG, so the unauthenticated plaintext is discarded - impact is design hygiene (any future caller that forwards the mbuf despite the error would emit unverified plaintext). fix.diff stops the TAIL write-back on authentication failure; buffering the whole stream would require an API redesign (documented, not attempted).

Threat / reachability

Design hygiene: decrypt-before-verify; current callers discard on error.

Privilege escalation assessment

n/a (hardening)

Fix

Skip the tail m_copyback when ret != 0 (comment documents the residual in-place loop).

Kernel references

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

not_testable

fix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier

batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
↓ fix.diffper-fix-DF-2365

Confirmed kernel references

Detail

Exploit chain

no escalation path (Info-tier hardening; see VERDICT.md)

Evidence (decisive lines)

VERDICT.md mechanism/verdict sections; fix.diff

PoC changes

none (source-only confirmation for this Info-tier item)

Verified recommended fix

Skip the tail m_copyback when ret != 0 (comment documents the residual in-place loop).

Verdict

source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Only in-tree caller is wg_noise.c:1027 (WireGuard), which frees the mbuf on EBADMSG, so the unauthenticated plaintext is discarded - impact is design hygiene (any future caller that forwards the mbuf despite the error would emit unverified plaintext). fix.diff stops the TAIL write-back on authentication failure; buffering the whole stream would require an API redesign (documented, not attempted).