Bug 295102 - inadequate bounds check in nlattr_get_multipath()
Summary: inadequate bounds check in nlattr_get_multipath()
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 16.0-CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Pouria Mousavizadeh Tehrani
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-05-08 16:26 UTC by Robert Morris
Modified: 2026-05-16 21:33 UTC (History)
1 user (show)

See Also:


Attachments
cause kernel crash in nlattr_get_multipath() (2.60 KB, text/plain)
2026-05-08 16:26 UTC, Robert Morris
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2026-05-08 16:26:48 UTC
Created attachment 270516 [details]
cause kernel crash in nlattr_get_multipath()

In sys/netlink/route/rt.c nlattr_get_multipath(), this code is
meant to prevent user code from passing in a too-large
nethop array-element length:

                if (__predict_false(rtnh->rtnh_len <= sizeof(*rtnh) ||
                    rtnh->rtnh_len > data_len)) {

But the critical use of rtnh_len is:

                len = NL_ITEM_ALIGN(rtnh->rtnh_len);
                data_len -= len;

And the alignment can increase the value:

#define NL_ITEM_ALIGN_SIZE              sizeof(uint32_t)
#define NL_ITEM_ALIGN(_len)             __align_up(_len, NL_ITEM_ALIGN_SIZE)

The attached demo program supplies nla->nla_len 71, so data_len starts
out 67. The first rtnh_len is 65, which is < 67, but NL_ITEM_ALIGN
changes it to 68, so that after subtraction data_len wraps to 65535.
Then the loop writes beyond the end of mp->nhops[] into whatever was
allocated after it by npt_alloc(). The result (for me) is the kernel
dereferencing a garbage pointer and crashing.

panic: Fatal page fault at 0xffffffc00076de7e: 0x2000f0008020203                
cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x74     
--- exception 13, tval = 0x2000f0008020203                                      
post_p_rtnh() at post_p_rtnh+0x12                                               
nl_parse_header() at nl_parse_header+0xa2                                       
nlattr_get_multipath() at nlattr_get_multipath+0xb4                             
nl_parse_attrs_raw() at nl_parse_attrs_raw+0xb6                                 
nl_parse_header() at nl_parse_header+0x92                                       
rtnl_handle_newroute() at rtnl_handle_newroute+0x58                             
rtnl_handle_message() at rtnl_handle_message+0x12a                              
nl_taskqueue_handler() at nl_taskqueue_handler+0x49e                            
taskqueue_run_locked() at taskqueue_run_locked+0x158                            
taskqueue_thread_loop() at taskqueue_thread_loop+0xd4                           
fork_exit() at fork_exit+0x68                                                   
fork_trampoline() at fork_trampoline+0xa                                        
KDB: enter: panic                                                               

FreeBSD  16.0-CURRENT FreeBSD 16.0-CURRENT #10 main-n251024-dc4728f334c9-dirty: Fri May  8 12:05:42 EDT 2026     rtm@xxx:/usr/obj/usr/rtm/symbsd/src/riscv.riscv64/sys/RTM riscv
Comment 1 commit-hook freebsd_committer freebsd_triage 2026-05-13 11:27:37 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=4329663a861ef74796b79b6b0872cfe10d31c591

commit 4329663a861ef74796b79b6b0872cfe10d31c591
Author:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
AuthorDate: 2026-05-12 11:34:28 +0000
Commit:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
CommitDate: 2026-05-13 09:44:28 +0000

    rtnetlink: Align RTA_MULTIPATH length validation in nlattr_get

    Fix length validation of RTA_MULTIPATH attributes in
    nlattr_get_multipath() by making sure the user request is align.

    PR:             295102
    Reported by:    Robert Morris <rtm@lcs.mit.edu>
    Reviewed by:    markj
    Fixes:          7e5bf68495cc ("netlink: add netlink support")
    MFC after:      3 days
    Differential Revision: https://reviews.freebsd.org/D56963

 sys/netlink/route/rt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
Comment 2 Pouria Mousavizadeh Tehrani freebsd_committer freebsd_triage 2026-05-13 11:28:30 UTC
Thank you for your report.
Comment 3 commit-hook freebsd_committer freebsd_triage 2026-05-16 21:22:42 UTC
A commit in branch stable/15 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=2c6617658f0cabb1e83a47da02882454e4210bd9

commit 2c6617658f0cabb1e83a47da02882454e4210bd9
Author:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
AuthorDate: 2026-05-12 11:34:28 +0000
Commit:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
CommitDate: 2026-05-16 21:21:50 +0000

    rtnetlink: Align RTA_MULTIPATH length validation in nlattr_get

    Fix length validation of RTA_MULTIPATH attributes in
    nlattr_get_multipath() by making sure the user request is align.

    PR:             295102
    Reported by:    Robert Morris <rtm@lcs.mit.edu>
    Reviewed by:    markj
    Fixes:          7e5bf68495cc ("netlink: add netlink support")
    MFC after:      3 days
    Differential Revision: https://reviews.freebsd.org/D56963

    (cherry picked from commit 4329663a861ef74796b79b6b0872cfe10d31c591)

 sys/netlink/route/rt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
Comment 4 commit-hook freebsd_committer freebsd_triage 2026-05-16 21:33:45 UTC
A commit in branch stable/14 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=44be923a2b6bacd664b7e87e486cccd6fcc7cbad

commit 44be923a2b6bacd664b7e87e486cccd6fcc7cbad
Author:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
AuthorDate: 2026-05-12 11:34:28 +0000
Commit:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
CommitDate: 2026-05-16 21:28:09 +0000

    rtnetlink: Align RTA_MULTIPATH length validation in nlattr_get

    Fix length validation of RTA_MULTIPATH attributes in
    nlattr_get_multipath() by making sure the user request is align.

    PR:             295102
    Reported by:    Robert Morris <rtm@lcs.mit.edu>
    Reviewed by:    markj
    Fixes:          7e5bf68495cc ("netlink: add netlink support")
    MFC after:      3 days
    Differential Revision: https://reviews.freebsd.org/D56963

    (cherry picked from commit 4329663a861ef74796b79b6b0872cfe10d31c591)
    (cherry picked from commit 2c6617658f0cabb1e83a47da02882454e4210bd9)

 sys/netlink/route/rt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)