⬢ DragonFlyBSD Kernel Audit
DF-3759 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3759",
  "file": "sys/dev/netif/alc/if_alc.c",
  "verdict": "inconclusive",
  "impact_class": "none",
  "reproduce": {
    "build": "cc -O2 -Wall -Wextra -o trigger trigger.c",
    "run": "vm.sh run_root 'cc -O2 -Wall -Wextra -o /root/trigger /root/trigger.c && /root/trigger'  (after scp of trigger.c)",
    "expected": "Source-level certain: alc_rxeof (sys/dev/netif/alc/if_alc.c:3307,3368,3372,3386) derives m->m_pkthdr.len / m->m_len from the 14-bit controller-DMA'd RRD_BYTES field with no bound against nsegs * alc_buf_size (1536) or ETHER_CRC_LEN, on MCLBYTES(2048) clusters. A faulty/malicious Atheros NIC can hand the stack an mbuf describing up to 16379 bytes in a 2048-byte cluster (heap OOB read / kernel heap info leak to unprivileged sockets) or negative lengths (mbuf invariant violation / panic). Runtime honestly inconclusive: guest has no Atheros PCI device (NO_ATHEROS_PCI, ifconfig=vtnet0 lo0, no hw.alc sysctl). trigger.c/run.log demonstrate the corrupted length arithmetic deterministically."
  },
  "kernel_refs": [
    "sys/dev/netif/alc/if_alc.c:3307",
    "sys/dev/netif/alc/if_alc.c:3368",
    "sys/dev/netif/alc/if_alc.c:3372",
    "sys/dev/netif/alc/if_alc.c:3375",
    "sys/dev/netif/alc/if_alc.c:3386",
    "sys/dev/netif/alc/if_alc.c:3400",
    "sys/dev/netif/alc/if_alc.c:3187",
    "sys/dev/netif/alc/if_alc.c:3653",
    "sys/dev/netif/alc/if_alcreg.h:1240",
    "sys/dev/netif/alc/if_alcreg.h:554"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "trigger.c",
    "build.sh",
    "run.sh",
    "run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}