DF-3415 — in6_pcbconnect() reads sin6_addr before sa_len validation

File: sys/netinet6/in6_pcb.c:343-345 (DF-3357/DF-3372 family, v6 pcb twin)

Build (on the guest)

cd /tmp/df3415
cc -O2 -Wall -o in6_v4mapped_oob in6_v4mapped_oob.c

Run (unprivileged)

su -m maxx -c ./in6_v4mapped_oob

Expected output (decisive lines)

A(groom 00 ff ff) first errno=49 (Can't assign requested address)
B(groom 00 00 00) first errno=22 (Invalid argument)
summary over 20 rounds per variant:
  A groom 00 ff ff : EADDRNOTAVAIL=20 EINVAL=0 other=0
  B groom 00 00 00 : EADDRNOTAVAIL=0 EINVAL=20 other=0
  C no groom       : EADDRNOTAVAIL=0 EINVAL=20 other=0

RESULT: VULNERABLE -- connect(2) error code is chosen by heap bytes OUTSIDE
        the supplied sockaddr length (read before sa_len validation).

What it proves

getsockaddr() kmallocs exactly the user-supplied sockaddr length (2..255 bytes) and copies that many bytes. A connect() on a UDP6 socket with a 17-byte sockaddr reaches:

• sys/netinet6/udp6_usrreq.c:596 and
• sys/netinet6/in6_pcb.c:344 (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))

before any sa_len == 28 validation (that check only runs later, in in6_pcbladdr() at sys/netinet6/in6_pcb.c:282). The predicate reads sin6_addr file-offsets 8..19; with a 17-byte sockaddr, bytes 17..19 are past the allocation and contain recycled heap bytes.

The PoC grooms the 24-byte M_SONAME slab zone (sizes 17..24 all round to the 24-byte chunk class; kfree() only overwrites bytes 0..7 with the free list link and does not scrub the rest) with a preceding rejected bind(), then immediately connect()s with a 17-byte sockaddr. The stale groom bytes alone decide whether the kernel returns EADDRNOTAVAIL (mapped pattern 00 00 ff ff completed by the OOB bytes) or EINVAL (validation finally reached). Variant A vs B differ only in heap bytes that were never part of the connect() sockaddr — a 20/20 vs 0/20 differential.

Impact ceiling

The OOB-read content does not flow back to userspace; it selects an errno (comparison oracle on 3+ stale heap bytes per attempt). Low severity, kernleak bucket — consistent with the filed family (DF-3357 Medium had the garbage address used as a packet destination; here it only gates two error returns because in6_pcbladdr() still rejects the short sockaddr).

VERDICT — DF-3415

status: reproduced | impact: leak | confidence: certain

The finding

in6_pcbconnect() (sys/netinet6/in6_pcb.c:337) reads sin6->sin6_addr at line 344 (IN6_IS_ADDR_V4MAPPED) before the sockaddr is validated. The validation (nam->sa_len != sizeof(*sin6), sin6->sin6_family != AF_INET6) lives in in6_pcbladdr() (sys/netinet6/in6_pcb.c:282-285) and is only reached at line 351, after the address-field read.

getsockaddr() (sys/kern/uipc_syscalls.c:1513-1532) allocates kmalloc(len, M_SONAME) with the exact user-supplied len (2 <= len, len <= SOCK_MAXADDRLEN) and copies exactly len bytes. Any len < 28 therefore makes every read of sin6_addr (file offsets 8..23) an out-of-bounds read past the allocation — here up to 16 bytes past a 2-byte allocation, or 3 bytes past a 17-byte one for the IN6_IS_ADDR_V4MAPPED window (offsets 8..19, sys/netinet6/in6.h:316-318).

Live unprivileged path (no UDP6 pru_preconnect exists — only v4 udp_preconnect, sys/netinet/udp_usrreq.c:1975):

connect(2) → getsockaddr(kmalloc(len))      uipc_syscalls.c:1513
  → soconnect → so_pru_connect              uipc_socket.c:685
  → udp6_connect                            udp6_usrreq.c:583
      reads sin6_addr at udp6_usrreq.c:596  (same family, first reader)
  → in6_pcbconnect                          in6_pcb.c:337
      reads sin6_addr at in6_pcb.c:344      ← THIS FINDING
  → (only on false) in6_pcbladdr            in6_pcb.c:275
      validates sa_len == 28 at in6_pcb.c:282

Reproduction (guest, DragonFly 6.5-DEVELOPMENT #0, X86_64_GENERIC, uid 1001)

Slab mechanics that make the groom deterministic (sys/kern/kern_slaballoc.c):

• zoneindex() (8-byte granularity below 128): sizes 17..24 all round to the 24-byte chunk zone — groom bind(24) and trigger connect(17) share it.
• _kfree() local path writes only chunk->c_Next (bytes 0..7) and pushes the chunk on the per-zone LIFO list z->z_LChunks; use_weird_array (free-scrub) defaults to 0 — bytes 8..23 survive the free.
• Both sys_bind (uipc_syscalls.c:177) and sys_connect allocate/free the soname on the syscall thread, same CPU → LIFO reuse is immediate.

IN6_IS_ADDR_V4MAPPED needs bytes 8..19 == 00*8 || 00 00 ff ff. The 17-byte trigger supplies bytes 0..16 (zeros); bytes 17..19 are stale heap bytes from the groom. Results (3 independent runs × 20 rounds each, 100% stable):

A vs B differ only in heap bytes that lie outside the sockaddr handed to connect(). The errno is therefore chosen by out-of-bounds heap reads that happen before validation. Full logs: run.log, run.2.log.

Attribution

Externally the errno cannot distinguish which of the two premature reads decided (both read the same bytes: udp6_usrreq.c:596 first, then in6_pcb.c:344); the code trace pins both. The finding filed against this file is the in6_pcb.c:344 instance — it is unconditional in in6_pcbconnect() and the only live caller (udp6_usrreq.c:608) feeds it unvalidated lengths; tcp_syncache.c:791 passes a kernel-built full-size sockaddr. in6_pcbbind() is not affected (its sa_len check at in6_pcb.c:129 precedes the first field read at line 138).

Impact ceiling (honest)

• The stale bytes never reach userspace; they gate two error returns (EADDRNOTAVAIL vs EINVAL) — a comparison oracle on 3 heap bytes per attempt (the predicate is an AND of byte equalities, so per-attempt leakage is sub-bit in practice).
• No escalation path: in6_pcbladdr() still rejects every short sockaddr, so no connection state is ever established from OOB data.
• Severity Low (kernleak), consistent with DF-3372 (Low); DF-3357 was Medium only because there the garbage address became the packet destination.

Fix validation

fix.diff moves the sa_len/family validation ahead of the IN6_IS_ADDR_V4MAPPED read (identical shape to the family fix; mirrors the checks already at in6_pcb.c:282-285 and the bind-side discipline at in6_pcb.c:129-135). Not rebuilt/tested in-guest: Low-severity out-of-bounds read whose observable effect is an errno choice; the conditional-verification policy for this batch reserves the full kernel-rebuild cycle for Critical/High or memcorrupt/privesc findings. The patch is a pure reorder — after it, every connect() with sa_len != 28 returns EINVAL before any address field is read, killing the oracle by construction.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.