⬢ DragonFlyBSD Kernel Audit
DF-3454 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-3454",
  "title": "amrr stale rate index (amn_rix) OOB read after HT->legacy rateset flip",
  "verdict": "reproduced",
  "impact": "leak",
  "reproduce": {
    "build": "scp amrroob.c Makefile dfbsd:/root/amrroob/ && guest: cd /root/amrroob && make SYSDIR=/usr/src/sys",
    "run": "guest: kldload /root/amrroob/amrroob.ko && sysctl amrroob.run=1; dmesg | grep amrroob",
    "expected": "PHASE3 returns rix=76 against legacy rs_nrates=12 (OOB); PHASE4 discloses ni_chan pointer bytes (rs_rates[18..25]) and 0xA5 meshid markers via ni_txrate; PHASE5 returns rix=-1 for empty-rateset tmp node"
  },
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_amrr.c:145",
    "sys/netproto/802_11/wlan/ieee80211_amrr.c:208",
    "sys/netproto/802_11/wlan/ieee80211_amrr.c:259",
    "sys/netproto/802_11/wlan/ieee80211_amrr.c:274",
    "sys/netproto/802_11/wlan/ieee80211_amrr.c:339",
    "sys/netproto/802_11/wlan/ieee80211_amrr.c:434",
    "sys/netproto/802_11/wlan/ieee80211_ratectl.c:119",
    "sys/netproto/802_11/wlan/ieee80211_node.c:1276",
    "sys/dev/netif/bwn/bwn/if_bwn.c:6304",
    "sys/bus/u4b/wlan/if_run.c:2617",
    "sys/bus/u4b/wlan/if_run.c:3345",
    "sys/dev/netif/iwm/if_iwm.c:4366"
  ],
  "artifacts": [
    "amrroob.c", "Makefile", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log",
    "fix.diff", "fix_module_only.log", "fix_module_only_attempt1.log",
    "fix_run.log", "fix_build.log",
    "env.txt", "VERDICT.md", "README.md", "manifest.json", "verdict.json"
  ]
}