DF-0594 / run.log

=================== INVARIANTS build (default kernel) ===================
=== DF-0594 TKIP RX length-underflow proof ===
kernel: sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c
cipher: ic_header=8 ic_trailer=4 ic_miclen=8 (u_int)
frame:  m_pkthdr.len=32 (int), hdrlen=24, total=32
WEP floor 32 (ieee80211_crypto.c:598 IEEE80211_WEP_MINLEN)
TKIP need 36 (hdrlen + ic_header + ic_trailer)
build:  INVARIANTS (default X86_64_GENERIC — KASSERT = panic)

[line 994] data_len = m_pkthdr.len - (hdrlen + ic_header + ic_trailer)
         = (int)32 - (u_int)(24 + 8 + 4)
         = (u_int)32 - (u_int)36   [int promoted to u_int]
         = 0x00000000fffffffc  (size_t)  <-- SIGNED/UNSIGNED WRAP (CWE-190)
RESULT: data_len 4294967292 > frame_len 32 => UNDERFLOW CONFIRMED

[INVARIANTS] calling verbatim wep_decrypt; KASSERT(data_len==0) at ieee80211_crypto_tkip.c:698 fires:
panic: out of buffers with data_len 4294967292
cpuid = 0
Trace begins at wep_decrypt+ (DF-0594 KASSERT site)
Abort trap (core dumped)
INVARIANTS exit code: 134

=============== NO_INVARIANTS build (production kernel) =================
=== DF-0594 TKIP RX length-underflow proof ===
kernel: sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c
cipher: ic_header=8 ic_trailer=4 ic_miclen=8 (u_int)
frame:  m_pkthdr.len=32 (int), hdrlen=24, total=32
WEP floor 32 (ieee80211_crypto.c:598 IEEE80211_WEP_MINLEN)
TKIP need 36 (hdrlen + ic_header + ic_trailer)
build:  NO_INVARIANTS (production kernel — KASSERT compiled out)

[line 994] data_len = m_pkthdr.len - (hdrlen + ic_header + ic_trailer)
         = (int)32 - (u_int)(24 + 8 + 4)
         = (u_int)32 - (u_int)36   [int promoted to u_int]
         = 0x00000000fffffffc  (size_t)  <-- SIGNED/UNSIGNED WRAP (CWE-190)
RESULT: data_len 4294967292 > frame_len 32 => UNDERFLOW CONFIRMED

[NO_INVARIANTS] calling verbatim wep_decrypt with the frame buffer ending at a page boundary (+guard page):
  m_data=0x800473fe0  m_data+m_len=0x800474000  guard page starts at 0x800474000
  [SIGSEGV at 0x800474000 — OOB READ past mbuf data end]
RESULT: SIGSEGV in wep_decrypt ICV check — OOB READ CONFIRMED (CWE-125/CWE-787), page-fault on read past mbuf end.
NO_INVARIANTS exit code: 0

RUN_DONE inv_rc=134 noinv_rc=0