DF-2547
Unbounded input queue in ng_source_rcvdata allows system-wide mbuf exhaustion
Summary
ng_source_rcvdata enqueues every incoming mbuf via _IF_ENQUEUE without any IF_QFULL check. snd_queue.ifq_maxlen=2048 set in constructor but never enforced. XXX comment acknowledges gap. Attacker with root/netgraph access sends unlimited packets exhausting kernel mbuf zone causing system-wide DoS. queueOctets uint32 overflow after 4GiB corrupts statistics. NOTE: dead code does not compile not in build.
No comments yet.