DF-3260 — ipfw2 act_ofs unvalidated at rule install: heap OOB write, kernel panic, netisr infinite loop

File: sys/net/ipfw/ip_fw2.c (pass 2). Escalation of DF-0261 (which covers the OOB read side) to write/DoS sinks.

Build (guest, root)

cc -O -o poc_misalign poc_misalign.c
cc -O -o poc_write    poc_write.c
cc -O -o poc_regression poc_regression.c

Run (guest, root)

sysctl net.filters_default_to_accept=1   # keep ssh alive after kldload
kldload ipfw
ifconfig lo0 alias 127.0.255.255 netmask 255.255.255.255  # PoC1 only
./poc_misalign     # sends 2 UDP packets -> kernel PANICS on packet 2
./poc_write        # installs rule, IP_FW_ZERO -> 4-byte heap WRITE, prints proof

Expected output

poc_misalign (serial console, captured in panic.txt):

panic: -- unknown opcode 127
ipfw_chk() at ipfw_chk+0x2a1e
ipfw_check_in() at ipfw_check_in+0x23
pfil_run_hooks() ...
ip_input() ...

poc_write:

[+] rule 2000 installed (cmd_len=4, act_ofs=1)
[+] baseline cmd[3] = 0x0000012b
[+] IP_FW_ZERO(2000) done -> clear_counters() store fired
[+] after     cmd[3] = 0x00000128
[!!] 4-BYTE KERNEL HEAP WRITE CONFIRMED: cmd[3] 0x0000012b -> 0x00000128
    (value=max_log, offset=act_ofs*4+8, both attacker-chosen)

Fix validation

scp fix.diff guest:/tmp
(guest) cd /usr/src && git apply /tmp/fix.diff
(guest) cd /usr/src/sys/net/ipfw && make obj && \
        make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC
kldload /usr/obj/usr/src/sys/net/ipfw/ipfw.ko
./poc_write        -> IP_FW_ADD: Invalid argument
./poc_misalign     -> IP_FW_ADD: Invalid argument
dmesg: "ipfw: act_ofs 1 not on instruction boundary"
./poc_regression   -> PASS (valid rules still install; traffic flows)

Privilege ceiling

Rule installation requires root (raw socket: caps_priv_check(SYSCAP_NONET_RAW) sys/netinet/raw_ip.c:473) and is blocked at securelevel>=3 (sys/net/ipfw/ip_fw2_glue.c:65-69). HOWEVER, once a root-installed rule is in place, the panic/loop sinks are triggered by any packet that matches the rule — i.e. an unprivileged local user or a remote sender.

VERDICT — DF-3260

Status: reproduced (deterministic). Impact: panic/dos via packet-triggered kernel panic + netisr-occupying infinite loop; 4-byte kernel heap OOB write primitive (attacker-chosen offset within +256KB and value) demonstrated deterministically in-allocation and code-proven out-of-allocation.

Root cause

struct ip_fw.act_ofs (offset of the action instruction, in 32-bit words, from rule->cmd) is copied verbatim from the user-supplied rule and never validated against cmd_len or the instruction chain:

• copy: sys/net/ipfw/ip_fw2.c:4515 (rule->act_ofs = ioc_rule->act_ofs;)
• validation: ipfw_check_ioc_rule() (sys/net/ipfw/ip_fw2.c:5310-5551) validates sizes, opcodes, table ids, action placement — but act_ofs is never mentioned.

DF-0261 (pass 1) filed the resulting heap OOB read in the classification walk. Pass 2 established the additional sinks:

1. OOB WRITE, root-triggered — clear_counters() (sys/net/ipfw/ip_fw2.c:5204-5215), reached from IP_FW_ZERO / IP_FW_RESETLOG (ip_fw2.c:6610-6622): c ipfw_insn_log *l = (ipfw_insn_log *)ACTION_PTR(rule); if (l->o.opcode == O_LOG) /* 1-byte read at cmd+act_ofs*4 */ l->log_left = l->max_log; /* 4-byte WRITE at cmd+act_ofs*4+8, value = 4 bytes at cmd+act_ofs*4+4 */ act_ofs ∈ [0, 65535] → write anywhere up to +256KB past rule->cmd in the M_IPFW heap, value semi-controlled (read from +4). Demonstrstrated deterministically on the guest (see below).

2. OOB WRITE (decrement), packet-triggered — ipfw_log() (sys/net/ipfw/ip_fw2.c:1408-1416): l->log_left-- on an OOB ACTION_PTR when a rule containing an O_LOG instruction matches any packet and fw_verbose=1. Same reach: root installs once, any matching packet (unprivileged local user / remote sender) decrements 4 bytes at a root-chosen offset.

3. Kernel panic, packet-triggered (deterministic, reproduced) — the O_PROBE_STATE/O_CHECK_STATE state-hit jump (sys/net/ipfw/ip_fw2.c:4204-4210) sets cmd = ACTION_PTR(f) and walks the "action" chain from that offset. With act_ofs pointing inside the rule at an operand word, the operand bytes are interpreted as an opcode: - unknown opcode → panic("-- unknown opcode %d") ip_fw2.c:4368 - F_LEN == 0 operand → l -= cmdlen never terminates (ip_fw2.c:3616) → netisr infinite loop (soft hang). Reproduced: panic: -- unknown opcode 127 (panic.txt) via ipfw_chk → ipfw_check_in → pfil_run_hooks → ip_input.

4. OOB reads — ipfw_dummynet_io() ip_fw2.c:4425 (cmd = rule->cmd + act_ofs), lookup_next_rule() ip_fw2.c:3006 — same class as DF-0261.

Reproduction on the guest (DragonFly 6.5-DEVELOPMENT, stock INVARIANTS kernel)

PoC 1 — deterministic panic (poc_misalign.c)

Rule installed via setsockopt(IP_FW_ADD) (accepted — proving act_ofs is not validated): check-state ip from 127.0.255.255 to any keep-state allow, cmd_len=5, act_ofs=2 (pointing at the O_IP_SRC operand word 0xffff007f; byte 0 = 0x7f = opcode 127). Packet 1 creates the state; packet 2 makes O_PROBE_STATE jump to ACTION_PTR == &cmd[2]:

panic: -- unknown opcode 127
ipfw_chk() at ipfw_chk+0x2a1e
ipfw_check_in() at ipfw_check_in+0x23
pfil_run_hooks() at pfil_run_hooks+0x6f
ip_input() at ip_input+0x611
netmsg_service_loop() ...

(panic.txt, guest #0 stock kernel.) Two boots, two identical panics — fully deterministic. After root installs the rule, the second packet can be sent by any unprivileged user.

PoC 2 — deterministic 4-byte heap write (poc_write.c)

Rule: cmd = [O_LOG(len 3)][max_log=0x00000128][log_left][O_ACCEPT], cmd_len=4, act_ofs=1 → ACTION_PTR = the max_log word whose low byte 0x28 == O_LOG. IP_FW_ZERO(2000) → clear_counters() executes l->log_left = l->max_log → 4-byte store at cmd+1*4+8 (= the O_ACCEPT instruction word) with value 0x00000128 taken from cmd+1*4+4. Observed byte-exact via IP_FW_GET:

baseline cmd[3] = 0x0000012b      (O_ACCEPT insn)
after     cmd[3] = 0x00000128      (attacker-chosen max_log value)

The same store with act_ofs ≥ cmd_len writes past the allocation (RULESIZE = 92+4*cmd_len bytes). Two additional spray-based attempts at the cross-object form (poc_oobwrite.c, attempts 3-4) hard-wedged the guest at IP_FW_ZERO time — consistent with the write landing in freed-chunk heap metadata — but were not instrumented (no console output survives a wedge), so the out-of-allocation landing is carried by code analysis plus the in-allocation proof, not by a clean log.

Why no uid0 chain

Exploitation requires installing the malformed rule, which requires SYSCAP_NONET_RAW (root) and is blocked at securelevel>=3. The corruption cannot be initiated by an unprivileged user; only the trigger packet is unprivileged. Post-root kernel memory corruption on a host where root can already kldload code has no escalation value; severity is therefore graded on kernel-integrity/DoS impact (Medium), not privesc.

Fix (validated)

fix.diff adds to ipfw_check_ioc_rule(): - act_ofs >= cmd_len → EINVAL (bounds); - act_ofs must land exactly on an instruction boundary of the validated chain (act_ofs_ok), killing operand misinterpretation (panic/loop) and every OOB use of ACTION_PTR at once.

Validated on the guest (module rebuilt with -Werror, loaded): - poc_misalign: IP_FW_ADD: Invalid argument, dmesg ipfw: act_ofs 2 not on instruction boundary — panic impossible; - poc_write: rejected the same way — write impossible; - poc_regression: valid rules (act_ofs on action boundary, act_ofs on O_LOG boundary) still install; 2 packets traverse the state rule; IP_FW_GET works; kernel alive. No regression.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.