DF-2547

Unbounded input queue in ng_source_rcvdata allows system-wide mbuf exhaustion

Summary

ng_source_rcvdata enqueues every incoming mbuf via _IF_ENQUEUE without any IF_QFULL check. snd_queue.ifq_maxlen=2048 set in constructor but never enforced. XXX comment acknowledges gap. Attacker with root/netgraph access sends unlimited packets exhausting kernel mbuf zone causing system-wide DoS. queueOctets uint32 overflow after 4GiB corrupts statistics. NOTE: dead code does not compile not in build. [VERIFIED pass2: reproduced - 3000 real mbufs enqueued ifq_len 3000 vs maxlen 2048, no IF_QFULL anywhere; latent not-built; inline fix]

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — network stack
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U:C:N/I:N/A:H
CWE: CWE-400 Uncontrolled Resource Consumption
File: sys/netgraph7/ng_source.c
Lines: 564-567
Area: net
Discovered: 2026-07-28
Updated: 2026-07-28

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: dos
Confidence: certain
Tested: 2026-10-24 14:11:28
Attempts: 1
Runtime: 300s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: cd /root/work24/ngsource && sh build.sh
Run cmd: sysctl kern.dfv_ngsrc_run=4; sysctl -n kern.dfv_ngsrc_run

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-24 14:11:28
Runtime: —
Kernel: per-fix-DF-2547
fix.diff: findings/poc/DF-2547/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2547 · 2 files

File	Type	Description	Size
harness.c	—		7.6 KB	view raw
run.log	—		605 B	view raw

Fix verification

not_testable

↓ fix.diffper-fix-DF-2547

Confirmed kernel references

Detail

Evidence (decisive lines)

ngsource_456.log mode 4: ifq_len 3000 >> 2048

PoC changes

verbatim enqueue body; real mbufs

Verified recommended fix

IF_QFULL check + drop before enqueue

Verdict

ng_source_rcvdata (ng_source.c:563-567) enqueues without IF_QFULL; ifq_maxlen=2048 never enforced. 3000 real mbufs enqueued, ifq_len=3000 >> 2048: unbounded mbuf/memory exhaustion by the connected node. netgraph7 is not in the stock kernel (DF-2539); ng_source.c is additionally absent from sys/conf/files and cannot compile as-is (:743 undeclared ifq). The harness module compiles the pristine file with only the documented build adaptations (:743 ifq->ifsq; DFly API renames IF_ENQUEUE/altq/ifq_var includes); ng7 core (netgraph.ko) kldloaded for the framework.