DF-2600

SETIFACE passes non-NUL-terminated msg->data to ifunit bounded heap OOB read

Summary

NGM_SOURCE_SETIFACE hands user-controlled message buffer to ifunit() with only arglen<2 length check. ifunit() compares strncmp(ifp->if_xname name IFNAMSIZ) reads up to 16 bytes. If name shorter than IFNAMSIZ and not NUL-terminated strncmp reads (16-first_nul_pos) bytes past intended message data. With arglen=2 no NUL reads 14 bytes past allocation into heap-adjacent ng_mesg. Bytes only feed comparison not returned. Latent file not built by default. [VERIFIED pass2: reproduced - 2-byte SETIFACE data plus groomed residue completes lo0 in real ifunit resolved-lo0 vs garbage NULL; comparison-only bytes, latent file]

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Kernel memory leaks / uninitialized disclosure
Confidence: likely
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U:C:L/I:N/A:N
CWE: CWE-125 Out-of-bounds Read
File: sys/netgraph7/ng_source.c
Lines: 407-414
Area: net
Discovered: 2026-08-01
Updated: 2026-08-01

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: likely
Tested: 2026-10-24 14:11:29
Attempts: 1
Runtime: 300s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: cd /root/work24/ngsource && sh build.sh
Run cmd: sysctl kern.dfv_ngsrc_run=2; sysctl -n kern.dfv_ngsrc_run

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: likely
Tested: 2026-10-24 14:11:29
Runtime: —
Kernel: per-fix-DF-2600
fix.diff: findings/poc/DF-2600/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2600 · 2 files

File	Type	Description	Size
harness.c	—		7.6 KB	view raw
run.log	—		7 B	view raw

Fix verification

not_testable

↓ fix.diffper-fix-DF-2600

Confirmed kernel references

Detail

Evidence (decisive lines)

ngsource_all.log mode 2: resolved=lo0 via residue; mode 3: NULL

PoC changes

real ifunit + real interfaces

Verified recommended fix

require NUL-termination within arglen before ifunit()

Verdict

SETIFACE (ng_source.c:405-414) checks only arglen<2 before ifunit(msg->data) whose strncmp reads up to IFNAMSIZ: with 2-byte lo + groomed residue 0\0, ifunit() resolved lo0 (name completed past the message); control residue resolved NULL. Bytes feed the comparison only. netgraph7 is not in the stock kernel (DF-2539); ng_source.c is additionally absent from sys/conf/files and cannot compile as-is (:743 undeclared ifq). The harness module compiles the pristine file with only the documented build adaptations (:743 ifq->ifsq; DFly API renames IF_ENQUEUE/altq/ifq_var includes); ng7 core (netgraph.ko) kldloaded for the framework.