BOOTP/DHCP reply acceptance has zero origin validation and a fully deterministic transaction XID — spoofed reply gives same-L2 attacker total control of the diskless client (root/swap NFS server, hostname, default route)

Summary

The diskless-boot DHCP/BOOTP client accepts any UDP datagram landing on its unconnected *:68 socket as a valid reply. The entire acceptance test is xid==call.xid, hlen==, and bcmp(chaddr); soreceive is called with a NULL name so the source address and port are never inspected, and there is no giaddr/siaddr sanity check. Worse, the transaction id has zero entropy: gctx->xid is the constant 0xFFFF0000, advanced deterministically by 0x100 per interface and +1 per recompose, so an attacker can compute the exact XID of every query the client will ever send without ever seeing a packet. The only de-facto secret is the client MAC, which is broadcast in every DISCOVER on the local link. A same-L2 attacker races the legitimate server with a crafted OFFER/ACK, and the client then takes yiaddr/siaddr as its identity, mounts root (and optionally swap) from the attacker-chosen NFS server via md_mount, sets the attacker's hostname and default route — the client's entire operating system is supplied by the attacker: full pre-auth compromise of the netboot machine. This is the documented netboot threat model (RFC 2131 §7, no RFC 3118 authentication implemented) and DF-0802 already accepts the same-L2 attacker premise for its panics — but the deterministic XID plus absent source-port/address check removes even the weak off-link bar a randomized XID would have kept. Severity Medium: requires the non-default 'options BOOTP' diskless configuration (LINT64 only, absent from X86_64_GENERIC) and an adjacent attacker, but under that config impact is total client compromise — strictly worse than DF-0802's DoS. Not guest-testable (PXE harness; the audit guest boots from disk). Fix: karc4random() xid seed + require reply source port 67 (row diff).

Timeline

• 2026-09-02 Discovered during pass-2 audit of bootp_subr.c (GLM 5.3). DF-0802 re-verified, not re-reported (six panic consumers; the tag walk proven sound post-fix-analysis).