ng7 ksocket rcvdata trusts foreign m_tag sockaddr with no m_tag_len validation: short tag (e.g. minted by ng_tag with user-configured cookie/type/len) makes stag->sa overlap OOB heap handed to sosend
Summary
m_tag_locate matches only cookie/type regardless of m_tag_len; the code then reads stag->id and uses sa=&stag->sa with no check that the tag contains sizeof(ng_ID_t)+sizeof(struct sockaddr). ng7 ng_tag lets a control-plane user configure arbitrary tags prepended to forwarded data, so a shorter tag makes sosend() consume an OOB sockaddr: udp/raw output reads ~16 bytes past the tag allocation whose contents become the packet's destination address (heap bytes exfiltrated to an attacker-chosen endpoint) plus sa_family dispatch on garbage. Root-configured topology; ng7 not loadable on stock guest - not verified. Fix: validate m_tag_len before overlaying sa_tag. [VERIFIED pass2: precondition dead - ng_tag does not compile and is absent from SUBDIR so no in-tree producer of short sa_tags; missing m_tag_len check line-accurate]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3503 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 379 B | ↓ raw | |
| VERDICT.md | — | 1.8 KB | ↓ raw | |
| env.txt | — | 309 B | view raw | |
| fix.diff | — | 598 B | view raw | |
| manifest.json | — | 738 B | view raw | |
| run.log | — | 65 B | view raw | |
| verdict.json | — | 2.0 KB | view raw |
DF-3503 - ng7 ksocket sa_tag OOB via short m_tag
Precondition module ng_tag does not compile on this tree (ng_tag.c:64 sys/stddef.h fatal error; absent from ng7 module SUBDIR) -> no in-tree producer of short NGM_KSOCKET_COOKIE tags -> unreachable.
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
DF-3503 - VERDICT
status: not_reproduced | reproduced: 0 | impact: none | confidence: likely
Unreachable by construction on this tree: the attack vector requires ng_tag to mint a short m_tag, but sys/netgraph7/ng_tag.c DOES NOT COMPILE - kernel-compile with options NETGRAPH7_TAG failed at ng_tag.c:64 'fatal error: sys/stddef.h: No such file or directory' (FreeBSD-ism; DFly has no sys/stddef.h), and ng_tag is absent from the netgraph7 module SUBDIR (sys/netgraph7/Makefile). With no in-tree producer of foreign NGM_KSOCKET_COOKIE m_tags except ng_ksocket itself (which always writes the full sizeof(struct sa_tag) tag), the short-tag OOB in ng7 ng_ksocket rcvdata (:904-913 - m_tag_locate by cookie/type only, no m_tag_len check, sa=&stag->sa handed to sosend) cannot be armed. The code defect is line-accurate real; a custom kernel module minting a short tag would realize it, but that is not an in-tree surface on this tree. (DFly's v1 twin ng_tag/ksocket was fixed differently; v1 rcvdata uses meta not m_tags.)
Kernel references
- sys/netgraph7/ksocket/ng_ksocket.c:904
- sys/netgraph7/ksocket/ng_ksocket.c:913
- sys/netgraph7/ng_tag.c:64
Evidence
ng7build.log attempt-1 (ng_tag.c:64 fatal error captured in session log; config then rebuilt without TAG), sys/netgraph7/Makefile SUBDIR listing
Recommended fix
validate tag->m_tag_len >= sizeof(struct sa_tag) - offsetof(sa) before overlaying sa_tag in ng7 ng_ksocket_rcvdata.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
ng7build.log attempt-1 (ng_tag.c:64 fatal error captured in session log; config then rebuilt without TAG), sys/netgraph7/Makefile SUBDIR listing
PoC changes
none
Verified recommended fix
validate tag->m_tag_len >= sizeof(struct sa_tag) - offsetof(sa) before overlaying sa_tag in ng7 ng_ksocket_rcvdata.
Verdict
Unreachable by construction on this tree: the attack vector requires ng_tag to mint a short m_tag, but sys/netgraph7/ng_tag.c DOES NOT COMPILE - kernel-compile with options NETGRAPH7_TAG failed at ng_tag.c:64 'fatal error: sys/stddef.h: No such file or directory' (FreeBSD-ism; DFly has no sys/stddef.h), and ng_tag is absent from the netgraph7 module SUBDIR (sys/netgraph7/Makefile). With no in-tree producer of foreign NGM_KSOCKET_COOKIE m_tags except ng_ksocket itself (which always writes the full sizeof(struct sa_tag) tag), the short-tag OOB in ng7 ng_ksocket rcvdata (:904-913 - m_tag_locate by cookie/type only, no m_tag_len check, sa=&stag->sa handed to sosend) cannot be armed. The code defect is line-accurate real; a custom kernel module minting a short tag would realize it, but that is not an in-tree surface on this tree. (DFly's v1 twin ng_tag/ksocket was fixed differently; v1 rcvdata uses meta not m_tags.)
No comments yet.