DF-2593

Missing sopt_valsize validation causes OOB heap read in every set-mutation handler

Summary

move_set move_rule swap toggle flush all cast sopt->sopt_val to (int*) deref without checking sopt_valsize large enough. With small valsize(e.g. setsockopt buf 1) deref reads past kmalloc sopt_val buffer into adjacent slab bytes. Needs 8 bytes(move/swap) 4 bytes(toggle/flush) checks none. ipfw2 sibling validates everywhere ipfw3 does not. OOB values consumed only inside range checks (0,32) never returned no direct disclosure. Defense-in-depth hardening. [VERIFIED pass2: reproduced behavioral oracle - 1-byte TOGGLE payload with stale residue toggles set 5 while clean residue is rejected, bytes past sopt_valsize decide kernel state; EINVAL-before-read fix A/B]

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Kernel memory leaks / uninitialized disclosure
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:L/I:N/A:N
CWE: CWE-125 Out-of-bounds Read; CWE-20 Improper Input Validation
File: sys/net/ipfw3/ip_fw3_set.c
Lines: 105-244
Area: net
Discovered: 2026-08-01
Updated: 2026-08-01

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: certain
Tested: 2026-10-24 14:11:29
Attempts: 2
Runtime: 400s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: cc -O -o fw3_set_oob fw3_set_oob.c
Run cmd: ./fw3_set_oob

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-24 14:11:29
Runtime: —
Kernel: per-fix-DF-2593
fix.diff: findings/poc/DF-2593/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2593 · 2 files

File	Type	Description	Size
fw3_set_oob.c	—		3.4 KB	view raw
run.log	—		300 B	view raw

Fix verification

not_testable

↓ fix.diffper-fix-DF-2593

Confirmed kernel references

Detail

Evidence (decisive lines)

fw3_set_oob.log: case A delta 0x20 vs case B delta 0 -> OOB READ CONFIRMED line

PoC changes

raw setsockopt oracle through the real module

Verified recommended fix

validate sopt_valsize >= sizeof(int) (or 2 ints) in every set handler (in the rebuilt ipfw3 module fix)

Verdict

All five set-mutation handlers (ip_fw3_set.c:105-252) cast sopt->sopt_val to int and deref 4-8 bytes with no sopt_valsize check (staged by kern_setsockopt as kmalloc(valsize), uipc_syscalls.c:1257). Behavioral oracle via IP_FW_SET_TOGGLE with a 1-byte payload: the ip_fw_x_header residue immediately past the 1 logical byte completes the int; residue 00 00 00 -> num=5 -> set 5 toggled (IP_FW_SET_GET delta 0x20), residue 01 01 00 -> *num=0x01010005 -> rejected (delta 0). Same user payload, divergent kernel state changes driven by bytes past sopt_valsize. Values only feed range checks (never returned) -- hardening-class as filed. Root-only op path (raw socket).