/* * DF-0594 — code-level proof of the TKIP RX length-underflow defect. * * This harness is a FAITHFUL userspace reproduction of the vulnerable path in * sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c. It embeds the VERBATIM * body of wep_decrypt() (lines 662-723) and replicates the EXACT signed/unsigned * arithmetic from tkip_decrypt() line 994. The KASSERT semantics are taken from * sys/sys/systm.h:94-122 (X86_64_GENERIC builds INVARIANTS — * sys/config/X86_64_GENERIC:56 — so KASSERT = panic; without INVARIANTS * KASSERT is a no-op). * * Why a harness, not a runtime trigger: this KVM guest has no wifi radio, no * wlan(4) interface, and no wlan kld loaded (vtnet0/lo0 only). The bug lives on * the 802.11 RX software-crypto path (ieee80211_input -> ieee80211_crypto_decap * -> tkip_decap -> tkip_decrypt -> wep_decrypt) which is unreachable here. The * harness proves the defect deterministically by exercising the exact C the * kernel executes, with the exact types, on the exact too-short input the * finding describes. * * Two builds: * cc -O2 -Wall -o tkip_harness tkip_harness.c # INVARIANTS (default kernel) * cc -O2 -Wall -DNO_INVARIANTS -o tkip_harness_noinv tkip_harness.c # production * * The INVARIANTS build demonstrates the KASSERT panic (the deterministic DoS on * the default X86_64_GENERIC kernel). The NO_INVARIANTS build places the mbuf * data at the very end of a page with a PROT_NONE guard page immediately after, * so the OOB read at wep_decrypt:717 (*pos++) page-faults — exactly the * "cluster whose backing page ends inside the read window" scenario the finding * describes for production kernels. */ #include #include #include #include #include #include #include #include #include /* ---- Faithful type stubs matching the kernel headers --------------------- */ typedef uint8_t u8; typedef uint16_t u16; typedef uint32_t u32; typedef uint32_t __u32; typedef unsigned int u_int; /* ic_header/ic_trailer/ic_miclen are u_int * (sys/netproto/802_11/ieee80211_crypto.h:177-179) */ /* Constants from sys/netproto/802_11/ieee80211.h:1265-1283 */ #define IEEE80211_WEP_IVLEN 3 #define IEEE80211_WEP_KIDLEN 1 #define IEEE80211_WEP_EXTIVLEN 4 #define IEEE80211_WEP_CRCLEN 4 #define IEEE80211_WEP_MICLEN 8 #define IEEE80211_WEP_EXTIV 0x20 /* The tkip cipher descriptor values (ic_header/ic_trailer/ic_miclen), verbatim * from sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c:64-79. */ static const struct { u_int ic_header; /* IVLEN + KIDLEN + EXTIVLEN = 8 */ u_int ic_trailer; /* CRCLEN = 4 */ u_int ic_miclen; /* MICLEN = 8 */ } tkip = { IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + IEEE80211_WEP_EXTIVLEN, IEEE80211_WEP_CRCLEN, IEEE80211_WEP_MICLEN, }; /* ---- Minimal mbuf stub. The signedness is the heart of the bug: * m_pkthdr.len is `int` (sys/sys/mbuf.h:159), m_len is `int` (:86). * ic_header/ic_trailer/ic_miclen are `u_int` (ieee80211_crypto.h:177-179). * ------------------------------------------------------------------------ */ struct pkthdr { int len; }; struct mbuf { struct mbuf *m_next; int m_len; /* int, not size_t */ uint8_t *m_data; struct pkthdr m_pkthdr; /* m_pkthdr.len is int */ }; #define mtod(m, t) ((t)((m)->m_data)) /* ---- KASSERT semantics, faithful to sys/sys/systm.h:94-122 --------------- */ #ifdef NO_INVARIANTS #define KASSERT(exp, msg) do { } while (0) /* exactly kernel :117-119 */ #else /* kernel :95-96 with INVARIANTS: if (__predict_false(!(exp))) panic msg; */ #define KASSERT(exp, msg) do { if (!(exp)) panic msg; } while (0) #endif /* panic() — the kernel calls panic(); here we print the kernel-style message * and abort, mirroring a kernel panic. */ static void panic(const char *fmt, ...) __attribute__((noreturn)); static void panic(const char *fmt, ...) { va_list ap; va_start(ap, fmt); fprintf(stderr, "panic: "); vfprintf(stderr, fmt, ap); va_end(ap); fprintf(stderr, "cpuid = 0\n"); fprintf(stderr, "Trace begins at wep_decrypt+ (DF-0594 KASSERT site)\n"); abort(); } /* ---- crc32_table verbatim from ieee80211_crypto_tkip.c:397-450 ---------- */ static const __u32 crc32_table[256] = { 0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L, 0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L, 0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L, 0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL, 0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L, 0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L, 0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L, 0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL, 0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L, 0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL, 0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L, 0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L, 0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L, 0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL, 0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL, 0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L, 0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL, 0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L, 0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L, 0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L, 0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL, 0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L, 0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L, 0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL, 0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L, 0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L, 0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L, 0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L, 0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L, 0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL, 0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL, 0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L, 0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L, 0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL, 0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL, 0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L, 0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL, 0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L, 0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL, 0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L, 0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL, 0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L, 0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L, 0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL, 0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L, 0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L, 0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L, 0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L, 0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L, 0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L, 0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL, 0x2d02ef8dL }; /* =========================================================================== * VERBATIM copy of wep_decrypt() from * sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c lines 662-723. * S_SWAP (a local #define at kernel :610) is hoisted to file scope only so the * function body is byte-for-byte the audited code. Nothing else is altered. * =========================================================================== */ #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0) static int wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len) { u32 i, j, k, crc; u8 S[256]; u8 *pos, icv[4]; size_t buflen; /* Setup RC4 state */ for (i = 0; i < 256; i++) S[i] = i; j = 0; for (i = 0; i < 256; i++) { j = (j + S[i] + key[i & 0x0f]) & 0xff; S_SWAP(i, j); } /* Apply RC4 to data and compute CRC32 over decrypted data */ crc = ~0; i = j = 0; pos = mtod(m, uint8_t *) + off; buflen = m->m_len - off; for (;;) { if (buflen > data_len) buflen = data_len; data_len -= buflen; for (k = 0; k < buflen; k++) { i = (i + 1) & 0xff; j = (j + S[i]) & 0xff; S_SWAP(i, j); *pos ^= S[(S[i] + S[j]) & 0xff]; crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8); pos++; } m = m->m_next; if (m == NULL) { KASSERT(data_len == 0, ("out of buffers with data_len %zu\n", data_len)); break; } pos = mtod(m, uint8_t *); buflen = m->m_len; } crc = ~crc; /* Encrypt little-endian CRC32 and verify that it matches with the * received ICV */ icv[0] = crc; icv[1] = crc >> 8; icv[2] = crc >> 16; icv[3] = crc >> 24; for (k = 0; k < 4; k++) { i = (i + 1) & 0xff; j = (j + S[i]) & 0xff; S_SWAP(i, j); if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) { /* ICV mismatch - drop frame */ return -1; } } return 0; } /* ===================== end of verbatim wep_decrypt ======================= */ #undef S_SWAP /* ---- harness plumbing (NOT from the kernel) ------------------------------ */ /* The exact arithmetic from tkip_decrypt() at * sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c:992-994. Operand types * are byte-for-byte so the usual arithmetic conversions match the kernel: * m->m_pkthdr.len is int, tkip.ic_header/ic_trailer are u_int, the whole RHS is * u_int, so the int LHS is converted to unsigned and the subtraction wraps. */ static size_t tkip_decrypt_data_len(int m_pkthdr_len, int hdrlen) { /* line 994, verbatim expression: */ return m_pkthdr_len - (hdrlen + tkip.ic_header + tkip.ic_trailer); } #ifdef NO_INVARIANTS static sigjmp_buf oob_jmp; static volatile sig_atomic_t got_sigsegv; static void sigsegv_handler(int sig, siginfo_t *si, void *uc) { (void)sig; (void)uc; got_sigsegv = 1; fprintf(stderr, " [SIGSEGV at %p — OOB READ past mbuf data end]\n", si->si_addr); siglongjmp(oob_jmp, 1); } #endif int main(void) { /* The trigger frame from the finding: 24-byte 802.11 data header * (Protected) + 8-byte TKIP IV/EIV (ExtIV set). No payload/ICV/MIC. * Exactly IEEE80211_WEP_MINLEN = 32 bytes — the WEP-only floor enforced by * the upper layer (ieee80211_crypto.c:598). TKIP actually needs >= 36. */ const int hdrlen = 24; /* 3-address data hdr */ const int frame_len = hdrlen + (int)tkip.ic_header; /* 24 + 8 = 32 */ const u_int decrypt_need = hdrlen + tkip.ic_header + tkip.ic_trailer; /* 36 */ struct mbuf mbuf; u8 rc4key[16] = {0}; /* key bytes irrelevant — underflow precedes outcome */ fprintf(stderr, "=== DF-0594 TKIP RX length-underflow proof ===\n"); fprintf(stderr, "kernel: sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c\n"); fprintf(stderr, "cipher: ic_header=%u ic_trailer=%u ic_miclen=%u (u_int)\n", tkip.ic_header, tkip.ic_trailer, tkip.ic_miclen); fprintf(stderr, "frame: m_pkthdr.len=%d (int), hdrlen=%d, total=%d\n", frame_len, hdrlen, frame_len); fprintf(stderr, "WEP floor 32 (ieee80211_crypto.c:598 IEEE80211_WEP_MINLEN)\n"); fprintf(stderr, "TKIP need %u (hdrlen + ic_header + ic_trailer)\n", decrypt_need); fprintf(stderr, "build: %s\n", #ifdef NO_INVARIANTS "NO_INVARIANTS (production kernel — KASSERT compiled out)" #else "INVARIANTS (default X86_64_GENERIC — KASSERT = panic)" #endif ); fprintf(stderr, "\n"); /* ---- Step 1: show the line-994 arithmetic underflows ----------------- */ size_t data_len = tkip_decrypt_data_len(frame_len, hdrlen); fprintf(stderr, "[line 994] data_len = m_pkthdr.len - (hdrlen + ic_header + ic_trailer)\n"); fprintf(stderr, " = (int)%d - (u_int)(%d + %u + %u)\n", frame_len, hdrlen, tkip.ic_header, tkip.ic_trailer); fprintf(stderr, " = (u_int)%u - (u_int)%u [int promoted to u_int]\n", (u_int)frame_len, (u_int)decrypt_need); fprintf(stderr, " = 0x%016zx (size_t) <-- SIGNED/UNSIGNED WRAP (CWE-190)\n", data_len); if (data_len <= (size_t)frame_len) { fprintf(stderr, "RESULT: no underflow (unexpected)\n"); return 2; } fprintf(stderr, "RESULT: data_len %zu > frame_len %d => UNDERFLOW CONFIRMED\n", data_len, frame_len); #ifdef NO_INVARIANTS /* ---- Step 2: prove the OOB read at wep_decrypt:717 ----------------- * Place the frame at the very end of a writable page, with a PROT_NONE * guard page immediately after. The ICV check loop does *pos++ starting at * offset 32 == m_len, i.e. the first read is one byte PAST the data — the * first byte of the guard page -> SIGSEGV. This is exactly the "cluster * whose backing page ends inside the read window" page-fault the finding * describes for production (non-INVARIANTS) kernels. */ long ps = sysconf(_SC_PAGESIZE); size_t mapsz = (size_t)ps * 2; uint8_t *region = mmap(NULL, mapsz, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (region == MAP_FAILED) { perror("mmap"); return 2; } /* guard page: unmap PROT on the second page */ if (mprotect(region + ps, ps, PROT_NONE) != 0) { perror("mprotect"); return 2; } uint8_t *data = region + ps - frame_len; /* data ends exactly at page end */ memset(data, 0, frame_len); mbuf.m_next = NULL; mbuf.m_len = frame_len; mbuf.m_data = data; mbuf.m_pkthdr.len = frame_len; struct sigaction sa, oldsa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = sigsegv_handler; sa.sa_flags = SA_SIGINFO; sigemptyset(&sa.sa_mask); sigaction(SIGSEGV, &sa, &oldsa); fprintf(stderr, "\n[NO_INVARIANTS] calling verbatim wep_decrypt with the " "frame buffer ending at a page boundary (+guard page):\n"); fprintf(stderr, " m_data=%p m_data+m_len=%p guard page starts at %p\n", (void*)data, (void*)(data + frame_len), (void*)(region + ps)); int rc; if (sigsetjmp(oob_jmp, 1) == 0) { rc = wep_decrypt(rc4key, &mbuf, hdrlen + tkip.ic_header, data_len); fprintf(stderr, "[wep_decrypt returned %d — no fault (data was in-bounds " "padding on this allocator)]\n", rc); if (got_sigsegv) return 2; /* If no fault, it means the read landed in the same page's tail * padding; the OOB read still happened but was absorbed. Report that * honestly. */ fprintf(stderr, "RESULT: OOB read occurred but was absorbed by in-page " "padding (no page fault this run); defect still present " "(CWE-125/CWE-787) — repeat with a guard page boundary.\n"); } else { fprintf(stderr, "RESULT: SIGSEGV in wep_decrypt ICV check — OOB READ " "CONFIRMED (CWE-125/CWE-787), page-fault on read past mbuf end.\n"); } sigaction(SIGSEGV, &oldsa, NULL); #else /* ---- Step 2: prove the KASSERT panic (INVARIANTS build) ------------- */ static uint8_t backing[64]; memset(backing, 0, sizeof(backing)); mbuf.m_next = NULL; mbuf.m_len = frame_len; mbuf.m_data = backing; mbuf.m_pkthdr.len = frame_len; fprintf(stderr, "\n[INVARIANTS] calling verbatim wep_decrypt; " "KASSERT(data_len==0) at ieee80211_crypto_tkip.c:698 fires:\n"); fflush(stderr); int rc = wep_decrypt(rc4key, &mbuf, hdrlen + tkip.ic_header, data_len); fprintf(stderr, "[wep_decrypt returned %d] (UNEXPECTED — KASSERT should " "have panicked)\n", rc); return 2; /* unreachable on INVARIANTS build */ #endif return 0; }