DF-3491 — v1 ng_pppoe PRIMED branch: unvalidated ph->length → kernel

heap OOB read disclosed in the emitted PADO

twin of ng7 DF-3487; third sink distinct from DF-0457 (ethernet-hook path)

File: sys/netgraph/pppoe/ng_pppoe.c — the LIVE v1 netgraph stack (stock-loadable: kldload ng_pppoe).

Root cause

ng_pppoe_rcvdata() session-hook branch, PPPOE_PRIMED state (:1297-1359):

• m_pullup(sizeof(*wh)) only (:1304-1309) — 20 bytes contiguous;
• length = ntohs(wh->ph.length) (:1312) — never validated against m->m_pkthdr.len;
• get_tag(ph, PTT_SRV_NAME) (:1340), get_tag(ph, PTT_HOST_UNIQ) (:1353), scan_tags(sp, ph) (:1356) all bound their walk by &ph->tag[0] + ntohs(ph->length) under the comment "assume we already sanity checked ph->length" (ng_pppoe.c:280-282);
• insert_tag(sp, tag) → make_packet() (:376) bcopy's the attacker-shaped Service-Name tag (up to ~1470 bytes) into the PADO and sendpacket() emits it on the ethernet hook.

The session branch below (:1221-1229) does validate (m_pkthdr.len < length → drop); the ethernet discovery branch is DF-0457; this PRIMED branch is a third, distinct sink.

Reproduce (guest, root)

kldload ng_socket && kldload ng_pppoe
cc -O -o ppdprimed ppdprimed.c && ./ppdprimed

Pure-userland harness (no helper module): control+data ng_socket; graph srvN:eN<->pppoe:ethernet, srvN:sN<->pppoe:svcN; NGM_PPPOE_OFFER puts svcN in PRIMED; a 32-byte PADI (ph.length=1024, SRV tag claims 900 data bytes, 8 real) is sent down the session hook; the PADO comes back on the ethernet-side hook.

Expected output (stock module)

[+] round N: PADO received: 945 bytes (expected 945 ...)
    [DF-3491] Service-Name carries 892 bytes read OOB past the 32-byte mbuf
      ptr-like sequences found: 14
    [DF-3493] AC-COOKIE = raw kernel sess_con pointer 0xfffff8008d9e65e0

Busy-heap boots leak live pointers in the OOB region — run.log (first invocation) contains 0xfffff8008dcf2800 (direct-map heap), 0xffffffff806bd330 / 0xffffffff806bc610 (kernel text/data), 0xfffff8004f0a25d0, mbuf metadata (00 08 00 00, 00 03 c0 00). run.2.log is the 3/3-rounds stability run.

Threat model

The PRIMED branch parses a PADI echoed back by the PPPoE server daemon (the standard PADI→PADO offer flow); a daemon relaying peer-supplied PADI payload from an unauthenticated LAN peer delivers attacker-chosen ph->length. Direct trigger also by the netgraph-controlling root user. Impact: kernel heap disclosure (pointers + adjacent objects) and potential panic when the tag walk crosses an unmapped page (up to 0xFFFF).

Fix

fix.diff mirrors the session-branch check (m->m_pkthdr.len - sizeof(*wh) < length → EMSGSIZE). Validated: after module rebuild the identical input is rejected 3/3 (sendto: Message too long), no PADO, no crash (fixrun.log).

DF-3491 — VERDICT

reproduced / leak / certain — kernel heap OOB read (892 bytes past a 32-byte mbuf per packet) actively disclosed in an emitted PADO frame, plus panic potential at ph->length up to 0xFFFF. Same defect class and sink shape as ng7's verified DF-3487; this is the v1 (live-stack) twin.

How it was reproduced

./ppdprimed (root, stock ng_pppoe.ko + ng_socket.ko):

1. cs = socket(AF_NETGRAPH, SOCK_DGRAM, NG_CONTROL), node named srvN (bind), ds = socket(..., NG_DATA) connect'ed to srvN:.
2. NGM_MKPEER(".:", pppoe, eN, ethernet) + NGM_CONNECT(".:", sN ↔ path "eN" : svcN) + NGM_PPPOE_OFFER("svcN", ac_name="pocAC") → session hook svcN enters PPPOE_PRIMED.
3. sendto(ds, padi32, "sN") with the crafted 32-byte PADI (ph.length=1024, Service-Name tag header claiming 900 data bytes, 8 real bytes "SERVPADI").
4. Kernel path: ng_pppoe_rcvdata else-branch (:1253) → PRIMED (:1297) → no m_pullup beyond 20 bytes, length=1024 never checked against m_pkthdr.len=32 → get_tag(PTT_SRV_NAME) accepts the tag whose data spans [24,924) of a 32-byte mbuf → make_packet bcopy's 4+900 bytes → PADO (945 bytes total) emitted to the ethernet hook → captured on the ng_socket data hook.

Decisive evidence

• run.2.log: 3/3 rounds, each PADO exactly 945 bytes with the Service-Name tag carrying 892 bytes beyond the 32-byte input; AC-COOKIE = 0xfffff8008d9e46f0 every round.
• run.log (busy-heap boot): OOB region contains live kernel pointers (0xfffff8008dcf2800, 0xfffff8004f0a25d0, kernel-image pointers 0xffffffff806bd330, 0xffffffff806bc610) and mbuf metadata — 14 ptr-like sequences in one capture. Kernel-memory pattern consistent across runs.
• fixrun.log (patched module, fix.diff): identical input rejected 3/3 with EMSGSIZE (the new check), zero PADO output, no crash.

Exploit chain / ceiling

Information disclosure: unauthenticated LAN peer (when the server daemon relays PADI payload, the standard offer flow) reads kernel heap around the mbuf zone: pointers defeat KASLR-style layout randomization and feed follow-on corruption bugs. ph->length up to 0xFFFF can walk the tag header parse ~64 KB past the packet → single-packet panic potential (not needed for the leak; DF-3487's ng7 analysis showed the same). No write primitive on this path.

Fix validation

fix.diff adds the session-branch check to the PRIMED branch (:1312→ after code = wh->ph.code;): if (m->m_pkthdr.len - sizeof(*wh) < length) LEAVE(EMSGSIZE);. Module rebuilt in-guest (/usr/src/sys/netgraph/pppoe), reloaded, PoC re-run: baseline 945-byte PADO w/ OOB → patched: sendto: Message too long 3/3, no PADO, no crash. fix_status=fixed.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.