Dead empty-body bounds check on DLCI in nglmi_rcvdata case 6 protected only by nglmi_checkdata
Summary
nglmi_rcvdata segsize==6 branch IE type 0x07/0x57 dlci computed as 16-bit value then if((dlci<1024)&&(dlci>0)) evaluated but body just XXX comment so dlci never bounded locally. dlci_state[dlci] accessed :709/:716 with dlci up to 65535. dlci_state u_char[1024] so [1024-65535] OOB read+write. NOT currently exploitable nglmi_checkdata:962 rejects dlci>1023 before second pass GROUP4 stickiness same data both passes. Defense-in-depth latent-bug single invariant in separate function prevents Critical. [VERIFIED pass2: source-confirmed dead empty-body check NOT reachable-OOB since checkdata rejects dlci over 1023 - CORRECTS sibling DF-0564 framing; identical dead body in netgraph v1 copy noted; local-bounds fix compile-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2604 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.9 KB | ↓ raw | |
| README.md | — | 233 B | ↓ raw | |
| build.sh | — | 85 B | view raw | |
| run.sh | — | 49 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 640 B | view raw | |
| verdict.json | — | 2.3 KB | view raw | |
| fix.diff | — | 708 B | view raw |
DF-2604 evidence pack
- finding: sys/netgraph7/lmi/ng_lmi.c (689-716)
- verdict: reproduced (certain) - see VERDICT.md
- source-only confirmation (no runtime PoC)
- reproduce: build.sh / run.sh
- fix.diff: present, git-apply-able
DF-2604 - Verification Verdict
Status: reproduced Impact: none (hardening) Confidence: certain
Mechanism
The segsize==6 (group-of-4) path builds dlci from two full bytes (0..65535) and then executes an EMPTY if ((dlci < 1024) && (dlci > 0)) { / XXX / } body - a validation that validates nothing. The actual protection lives far away in nglmi_checkdata, which rejects dlci > 1023 before nglmi_rcvdata ever indexes sc->dlci_state[dlci] (size MAXDLCI+1 = 1024).
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain dead-body check; NOT a reachable OOB today (checkdata gate confirmed at the case 0x07/0x57 tail: dlci > 1023 -> goto reject). This corrects the framing of sibling DF-0564 (same file/lines, claimed reachable OOB - it is not, same gate). fix.diff implements the intended bounds check locally so rcvdata no longer relies on a distant validator; the identical empty body also exists in the netgraph v1 copy sys/netgraph/lmi/ng_lmi.c:698-704 (noted for the orchestrator to file separately if desired).
Threat / reachability
Robustness: the only thing standing between a remote LMI peer and dlci_state[] is a validator in a different function.
Privilege escalation assessment
n/a (hardening)
Fix
Replace the empty body with a real guard: if (dlci > MAXDLCI) goto nextIE; in both the case-6 and case-3 arms.
Kernel references
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier
batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
Confirmed kernel references
Detail
Exploit chain
no escalation path (Info-tier hardening; see VERDICT.md)
Evidence (decisive lines)
VERDICT.md mechanism/verdict sections; fix.diff
PoC changes
none (source-only confirmation for this Info-tier item)
Verified recommended fix
Replace the empty body with a real guard: if (dlci > MAXDLCI) goto nextIE; in both the case-6 and case-3 arms.
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain dead-body check; NOT a reachable OOB today (checkdata gate confirmed at the case 0x07/0x57 tail: dlci > 1023 -> goto reject). This corrects the framing of sibling DF-0564 (same file/lines, claimed reachable OOB - it is not, same gate). fix.diff implements the intended bounds check locally so rcvdata no longer relies on a distant validator; the identical empty body also exists in the netgraph v1 copy sys/netgraph/lmi/ng_lmi.c:698-704 (noted for the orchestrator to file separately if desired).
No comments yet.