⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2366

rc4_init lacks keylen>0 validation reading key[0] 256 times for non-positive keylen

Summary

rc4_init KSA loop reads key[k] at :72 BEFORE the keylen check at :74. With keylen<=0 (or non-positive int) ++k>=keylen is always true so k=0 every iteration - loop reads key[0] 256 times into the S-box with a possibly-NULL key pointer. Defensive defect: every in-tree caller (ng_mppc ng_mppc7) passes keylen=8 or 16 from validated PPP config with a 16-byte key buffer. No current path triggers it but latent API misuse risk. [VERIFIED pass2: runtime reproduced - keylen 0 guard-page SIGSEGV in verbatim schedule loop; no in-tree caller; early-return fix]

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2366 · 10 files
FileTypeDescriptionSize
VERDICT.md — 1.6 KB ↓ raw
README.md — 239 B ↓ raw
build.sh — 132 B view raw
run.sh — 99 B view raw
env.txt — 314 B view raw
manifest.json — 732 B view raw
verdict.json — 2.4 KB view raw
fix.diff — 287 B view raw
rc4_keylen0.c — 2.2 KB view raw
run.log — 354 B view raw
README.md
↓ download raw

DF-2366 evidence pack

  • finding: sys/crypto/rc4/rc4.c (58-77)
  • verdict: reproduced (certain) - see VERDICT.md
  • runtime PoC: rc4_keylen0.c
  • reproduce: build.sh / run.sh ; expected output in run.log
  • fix.diff: present, git-apply-able
VERDICT.md
↓ download raw

DF-2366 - Verification Verdict

Status: reproduced Impact: none (hardening) Confidence: certain

Mechanism

rc4_init never validates keylen. The schedule loop reads key[k] BEFORE the wrap check (j += perm[i] + key[k]; ... if (++k >= keylen) k = 0), so for keylen<=0 the loop reads key[0] 256 times while k stays 0; a caller passing a zero-length (or shorter-than-1) key buffer gets a 1-byte out-of-bounds read that also poisons the permutation.

Verdict

REPRODUCED: userland replica of the verbatim rc4_init loop with key pointing into a PROT_NONE guard page and keylen=0 faults deterministically on the key[0] read (SIGSEGV, exit 139; kernel logged the same signal for the guest binary). In the kernel the identical instruction reads one byte past the caller buffer. In-tree callers (netgraph mppc RC4 compression: ng_mppc.c rc4_init with KEYLEN(cfg.bits), 8-16 bytes) never pass keylen<=0, so this is defense-in-depth; no reachable fault found.

Threat / reachability

Any future rc4_init caller with user-controlled keylen (or 0) reads OOB; currently latent.

Privilege escalation assessment

n/a (no reachable caller)

Fix

Early-return on keylen<=0 before touching the key buffer.

Kernel references

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

not_testable

fix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier

batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
↓ fix.diffper-fix-DF-2366

Confirmed kernel references

Detail

Exploit chain

no escalation path: no in-tree rc4_init caller passes keylen<=0 (netgraph mppc passes 8-16); latent only

Evidence (decisive lines)

run.log: rc4_init(state, guard-page key, keylen=0) -> Segmentation fault (exit 139); kernel logged pid 1063 (p366s) signal 11; in-kernel equivalent is the 1-byte OOB read of the caller buffer

PoC changes

First demo put key[0] on the last byte of a MAPPED page (no fault, keylen=0 keeps k=0 so only key[0] is read); fixed by pointing the zero-length key buffer into a PROT_NONE guard page. Also: compile without -O, gcc dead-code-eliminates the unused schedule at -O.

Verified recommended fix

Early-return on keylen<=0 before touching the key buffer.

Verdict

REPRODUCED: userland replica of the verbatim rc4_init loop with key pointing into a PROT_NONE guard page and keylen=0 faults deterministically on the key[0] read (SIGSEGV, exit 139; kernel logged the same signal for the guest binary). In the kernel the identical instruction reads one byte past the caller buffer. In-tree callers (netgraph mppc RC4 compression: ng_mppc.c rc4_init with KEYLEN(cfg.bits), 8-16 bytes) never pass keylen<=0, so this is defense-in-depth; no reachable fault found.