DF-3444 — bpf_filter() executes unvalidated BPF programs (ipfw3_layer4 check_bpf)

Verdict

REPRODUCED on the stock 6.5-DEVELOPMENT #0 INVARIANTS kernel: a root user installs an ipfw3 rule whose O_LAYER4_BPF instruction embeds an arbitrary BPF program; the kernel executes it on every packet with no validation, yielding (a) a deterministic kernel OOB instruction walk, (b) an arbitrary-offset kernel-stack 32-bit write (BPF_ST, value fully controlled), and (c) full RIP control via overwrite of bpf_filter's saved return address (Stopped at 0x414142424343). FIX VALIDATED on a single-fix #1 kernel (fix.diff: runtime BPF_MEMWORDS bounds in bpf_filter.c + a bpf_validate() gate in check_bpf): the identical PoC ladder no longer panics and networking stays healthy.

The escalation chain to uid=0 for an unprivileged user is blocked by the same hard blocker documented for DF-2580 on this attack surface: the only path to installing a rule is setsockopt(raw_ip_socket, IPPROTO_IP, IP_FW_X=49, …) and creating a raw IP socket requires caps_priv_check(SYSCAP_NONET_RAW) (sys/netinet/raw_ip.c:473, rip_attach). A non-root user cannot enter the bug path. For a root user the primitive is already arbitrary kernel code execution: RIP control + a 16 GB positive-offset write window with per-packet repeatability on a no-SMEP/no-KASLR guest (ROP or shellcode-in-rule-memory trivially convert it).

Root cause (line-by-line)

bpf_filter() documents its own contract (sys/net/bpf_filter.c:498-509):

The kernel needs to be able to verify an application's filter code. Otherwise, a bogus program could easily crash the system.

The four memory-access cases index mem[pc->k] with no runtime bound check (bpf_filter.c:365-379), relying entirely on the caller having run bpf_validate():

case BPF_LD|BPF_MEM:
    A = mem[pc->k];          /* line 366 */
case BPF_LDX|BPF_MEM:
    X = mem[pc->k];          /* line 370 */
case BPF_ST:
    mem[pc->k] = A;          /* line 374 */
case BPF_STX:
    mem[pc->k] = X;          /* line 378 */

Compliant callers: bpf_setf (sys/net/bpf.c:1076, BIOCSETF/32/WF) and ng_bpf (sys/netgraph/bpf/ng_bpf.c:481, sys/netgraph7/bpf/ng_bpf.c:560).

The non-compliant caller: check_bpf (sys/net/ipfw3_layer4/ip_fw3_layer4.c:194-206):

slen = bpf_filter(bpf->bf_insn, (u_char *)m, m_lengthm(m, NULL), 0);  /* :201 */

The program reaches the kernel unvalidated because ipfw3 rule installation copies the instruction stream verbatim: ip_fw3_ctl_add_rule (ip_fw3.c:951, only a size sanity check) → ip_fw3_add_rule → add_rule_dispatch → bcopy(ioc_rule->cmd, rule->cmd, rule->cmd_len * 4) (ip_fw3.c:655) — no opcode walk, no BPF validation, no bf_len check. At match time ip_fw3_check dispatches filter_funcs[cmd->module][cmd->opcode] (ip_fw3.c:506) — with the ipfw3_layer4 module loaded, module=3, opcode=4 reaches check_bpf, which runs bpf->bf_insn directly.

Primitive on this kernel (X86_64_GENERIC #0, gcc 8.3)

From objdump -d /boot/kernel/kernel:

• prologue: mem[] is zeroed by rep stos of 8 qwords at rbp-0x60 → mem base = rbp-0x60 (bpf_filter+0x1d);
• the ST case compiles to mov %eax,-0x60(%rbp,%rdx,4) with edx = pc->k and no compare (bpf_filter+0x4d0..+0x4d3);
• saved return address of bpf_filter is at rbp+8 → BPF_ST k=26 (low dword), k=27 (high dword).

So one BPF_LD|BPF_IMM + two BPF_STs give RIP = any chosen 64-bit value. BPF_LD|BPF_MEM with the same k-range gives the matching read primitive; and because unvalidated programs need not terminate, even an all-zero "program" walks kernel memory as an endless BPF_LD|BPF_IMM stream (code 0) until it faults.

Reproduction (baseline #0)

# sysctl net.filters_default_to_accept=1
# kldload ipfw3; kldload ipfw3_basic; kldload ipfw3_layer4
# cc -O -o poc3444 poc3444.c
# ./poc3444 safe 0x12345678            # terminating in-bounds program: survives
# ./poc3444 empty                      # zero instructions:
Fatal trap 12 ... instruction pointer = 0xffffffff8072ac60
Stopped at bpf_filter+0x50: movzwl 0x8(%rdi),%r8d        # OOB instruction walk
# ./poc3444 store 0xcafebabe 0x08000000   # mem[0x08000000]=0xcafebabe:
--- trap 000000000000000c, rip = ffffffff8072b0e3 ---
bpf_filter() at bpf_filter+0x4d3                        # the OOB store itself
# ./poc3444 riptake 0x42424343 0x00004141 # ST k=26/27 -> saved RIP:
FStopped at 0x414142424343: kernel: type 12 trap, code=0

Each panic is deterministic (fresh vm.sh reset with-src, single run). Full signatures in panic.txt; runs in run.log.

Fix validation (patched #1 kernel)

fix.diff (applies clean with git apply): 1. sys/net/bpf_filter.c — runtime if (pc->k >= BPF_MEMWORDS) return 0; in all four MEM cases: bpf_filter is now safe even for unvalidated programs (defense in depth; decisive hunk). 2. sys/net/ipfw3_layer4/ip_fw3_layer4.c — check_bpf refuses to run any program that fails bpf_validate(bpf->bf_insn, (int)bpf->bf_len).

vm.sh reset with-src → apply → make nativekernel && make installkernel (full log: fix_build.log, 14896 lines, BUILD-RC=0) → reboot into #1 → identical ladder:

# ./poc3444 empty                            -> survives
# ./poc3444 store 0xcafebabe 0x08000000      -> survives
# ./poc3444 riptake 0x42424343 0x00004141    -> survives
# ping -c1 10.0.2.2                          -> 0.218 ms, ssh alive

Baseline corrupted/panicked on every run; patched kernel: zero panics, networking healthy. fix_status = fixed.

Privilege analysis (hard blocker for unpriv→root)

Identical entry gating to DF-0668/DF-2580 (same sockopt surface): rip_ctloutput is only reachable through a raw IP socket, and rip_attach (sys/netinet/raw_ip.c:460-475) gates on caps_priv_check(ai->p_ucred, SYSCAP_NONET_RAW | …). An unprivileged user cannot obtain the socket, cannot install the rule, and there is no secondary unvalidated path to bpf_filter (bpf.c and both ng_bpf implementations validate). Documented as a valid hard blocker, consistent with the accepted DF-2580 precedent on this exact surface.

Residual severity for a root attacker (and for any future in-kernel BPF consumer that forgets validation): full ring-0 compromise of kernel integrity — RIP control demonstrated on the no-SMEP/no-KASLR guest.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.