⬢ DragonFlyBSD Kernel Audit
DF-3437 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-3437",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Not exercised on the guest: the QEMU target has no 802.11 radio and DragonFly has no virtual 802.11 driver, so no vap can be created to drive the scan framework (same constraint that left DF-0640/DF-0587 unverified in pass 1). The defect is established by code walk: ieee80211_scan_timeout (ieee80211_scan.c:582-588, called from the unlocked ieee80211_node_timeout callout, ieee80211_node.c:2243-2256) and scan_iterate/scan_flush (:626-647) dispatch through ss->ss_ops with no com lock, while ieee80211_scan_vdetach (:137-155) under the lock calls scan_detach -> sta_detach (ieee80211_scan_sta.c:186-199) which kfrees ss->ss_priv (the sta_table) without clearing it before ss->ss_ops is NULLed. The check-then-call window lets the timers scan_age run SCAN_TABLE_LOCK + TAILQ walks on freed memory. Root-gated trigger (ifconfig wlanX destroy) racing a once-per-interval callout; DF-0587 family (lock-discipline hole at a different site).",
  "exploit_chain": "",
  "evidence": [
    "README.md: interleaving diagram + path:line walk",
    "ieee80211_node.c:2253 (unlocked callout call), ieee80211_scan.c:586-587 (unlocked ss_ops check-then-call), ieee80211_scan_sta.c:186-199 (sta_detach frees ss_priv, never clears it)"
  ],
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_scan.c:582",
    "sys/netproto/802_11/wlan/ieee80211_scan.c:586",
    "sys/netproto/802_11/wlan/ieee80211_scan.c:626",
    "sys/netproto/802_11/wlan/ieee80211_scan.c:639",
    "sys/netproto/802_11/wlan/ieee80211_scan.c:147",
    "sys/netproto/802_11/wlan/ieee80211_node.c:2253",
    "sys/netproto/802_11/wlan/ieee80211_scan_sta.c:186"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Guest lacks radio hardware; not testable this session. Suggested fix: hold IEEE80211_LOCK in the unlocked dispatchers (scan_timeout/iterate/flush/assoc_*) and clear ss->ss_priv in sta_detach before returning.",
  "recommended_fix": "Take IEEE80211_LOCK(ic) around the ss_ops dispatches in ieee80211_scan.c and clear ss->ss_priv in sta_detach()."
}