Missing arglen validation in NGM_SOURCE_GET_COUNTER allows uninitialized heap read
Summary
NGM_SOURCE_GET_COUNTER handler reads *(uint8_t*)msg->data without checking msg->header.arglen>=1. Every other data-reading command validates arglen. Message with arglen==0 reads uninitialized byte from heap allocation made by ngc_send kmalloc without M_ZERO. Byte used as array index 0..3 selects counter slot. NOTE: dead code does not compile not in build. [VERIFIED pass2: reproduced - GET_COUNTER arglen 0 reads residue byte 0xAA vs 0x00 deciding EINVAL vs counter via real ng_source.c; latent file absent from build; inline fix]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2546 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| harness.c | — | 7.6 KB | view raw | |
| build.sh | — | 121 B | view raw | |
| Makefile | — | 160 B | ↓ download | |
| run.log | — | 7 B | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
ngsource_all.log mode 0/1: index byte 0xaa -> EINVAL vs 0x00 -> counter
PoC changes
see NGSRC notes
Verified recommended fix
check msg->header.arglen >= 1 in GET_COUNTER
Verdict
GET_COUNTER (ng_source.c:479-496) reads (uint8_t)msg->data with no arglen check (every sibling command validates arglen). With arglen==0 the byte is past the requested allocation; groomed residue 0xAA -> EINVAL, residue 0x00 -> embed_counter[idx] returned: behavior decided by uninitialized heap. netgraph7 is not in the stock kernel (DF-2539); ng_source.c is additionally absent from sys/conf/files and cannot compile as-is (:743 undeclared ifq). The harness module compiles the pristine file with only the documented build adaptations (:743 ifq->ifsq; DFly API renames IF_ENQUEUE/altq/ifq_var includes); ng7 core (netgraph.ko) kldloaded for the framework.
No comments yet.