⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-3294

No rate limiting on ACKs sent in response to out-of-window segments (CVE-2016-5696 challenge-ACK family)

Summary

Every out-of-window or PAWS-failed data segment takes the dropafterack path and elicits an immediate, informative ACK via tcp_output() with no per-host or global rate limit; badport_bandlim gates only RST generation. An off-path attacker who has guessed/learned the 4-tuple can use the ACK-or-silence oracle at unlimited rate to infer receive-window edges and sequence-number state - the exact mechanism of the 2016 CCS off-path TCP sequence-inference attack (CVE-2016-5696) that prompted FreeBSD's net.inet.tcp.challenge_ack_limit mitigation. DFly never adopted a challenge-ACK limit. Off-path side-channel disclosure of connection activity; enables connection-tracking and spoofing-window DoS hijack of unauthenticated protocols. Low (off-path vantage + many probes; window-scale widens). Fix: challenge-ACK token bucket (sysctl-gated, default 100/s) before TF_ACKNOW on the out-of-window paths; over budget -> silent drop. [VERIFIED pass2: reproduced live on lo0 - 300 spoofed OOW segments produce 304 ack-only packets 1 to 1 amplification zero limiting, no challenge-ack budget exists anywhere in tcp_input; per-second budget fix sketched]

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-3294 · 7 files
FileTypeDescriptionSize
README.md — 848 B ↓ raw
VERDICT.md — 2.1 KB ↓ raw
chack.c — 5.0 KB view raw
fix.diff — 491 B view raw
live1.log — 3.4 KB view raw
manifest.json — 727 B view raw
verdict.json — 1.6 KB view raw
README.md
↓ download raw

DF-3294 -- verification pack

Method: Live PoC on the QEMU guest (stock INVARIANTS kernel) Status: REPRODUCED | impact: denial_of_service | confidence: certain

What this is

No challenge-ACK rate limiting exists anywhere in tcp_input.c (grep -i challenge: zero hits; no sysctl either). Live measurement on lo0: 300 spoofed out-of-window segments produced 304 ack-only packets (netstat counter delta) - a 1:1 ACK amplification with zero limiting (CVE-2016-5696 family: unthrottled ACK side channel enables off-path RST/SYN injection inference).

Build

cc -O -o <prog> <prog>.c   (on the guest)

Run

300 (root)

(success criterion: see VERDICT.md)

Evidence

live1.log DF-3294 section: ack-only delta=304 for 300 OOW segments; tcpdump saw 303 pkts from server

Kernel references: sys/netinet/tcp_input.c:2563-2600

VERDICT.md
↓ download raw

DF-3294 -- VERDICT

REPRODUCED (impact=denial_of_service, confidence=certain) Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Summary

No challenge-ACK rate limiting exists anywhere in tcp_input.c (grep -i challenge: zero hits; no sysctl either). Live measurement on lo0: 300 spoofed out-of-window segments produced 304 ack-only packets (netstat counter delta) - a 1:1 ACK amplification with zero limiting (CVE-2016-5696 family: unthrottled ACK side channel enables off-path RST/SYN injection inference).

How it was verified

  • Method: Live PoC on the QEMU guest (stock INVARIANTS kernel)
  • Kernel references: sys/netinet/tcp_input.c:2563-2600
  • Evidence: live1.log DF-3294 section: ack-only delta=304 for 300 OOW segments; tcpdump saw 303 pkts from server
  • Reachability: local-unpriv where noted in the summary; root-config for tun/lagg/carp/ipfw3/gre items; remote-facing for the packet parsers (wlan harnesses model the RX/TX path verbatim because the guest has no 802.11 hardware; precedent DF-0393/DF-0594/DF-0621/DF-0350).
  • Privesc assessment: no uid0 chain exists for any finding in this batch -- the memory-safety items are bounded info reads (kernleak bucket) or fault-injection-gated NULL derefs; nothing yields a write primitive or control over privileged state. The one panic-class live item (DF-3414) is root-only (SIOCIFDESTROY).

Fix

fix_status: not_testable -- Upstream-style fix = challenge-ack limiter (per-second budget, sysctl net.inet.tcp.ack_challenge_limit) at the dropafterack ACK emission; kernel not rebuilt for this Low/remote-hardening item. fix.diff: natural one-line/class fix authored against the read-only sys/ tree (never applied there).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

not_testable

Upstream-style fix = challenge-ack limiter (per-second budget, sysctl net.inet.tcp.ack_challenge_limit) at the dropafterack ACK emission; kernel not rebuilt for this Low/remote-hardening item.

↓ fix.diffper-fix-DF-3294

Confirmed kernel references

Detail

Evidence (decisive lines)

live1.log DF-3294 section: ack-only delta=304 for 300 OOW segments; tcpdump saw 303 pkts from server

Verified recommended fix

fix.diff

Verdict

No challenge-ACK rate limiting exists anywhere in tcp_input.c (grep -i challenge: zero hits; no sysctl either). Live measurement on lo0: 300 spoofed out-of-window segments produced 304 ack-only packets (netstat counter delta) - a 1:1 ACK amplification with zero limiting (CVE-2016-5696 family: unthrottled ACK side channel enables off-path RST/SYN injection inference).