DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2547

Unbounded input queue in ng_source_rcvdata allows system-wide mbuf exhaustion

Summary

ng_source_rcvdata enqueues every incoming mbuf via _IF_ENQUEUE without any IF_QFULL check. snd_queue.ifq_maxlen=2048 set in constructor but never enforced. XXX comment acknowledges gap. Attacker with root/netgraph access sends unlimited packets exhausting kernel mbuf zone causing system-wide DoS. queueOctets uint32 overflow after 4GiB corrupts statistics. NOTE: dead code does not compile not in build.

Discussion (0)

No comments yet.