⬢ DragonFlyBSD Kernel Audit
DF-3966 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3966",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain device-fed OOB read: rt2661_rx_intr finalizes the RX mbuf with m->m_pkthdr.len = m->m_len = (le32toh(desc->flags)>>16)&0xfff (rt2661.c:1101-1102) \u2014 up to 4095 from the DMAd descriptor \u2014 while the mbuf is a 2048-byte m_getcl cluster (rt2661.c:1055; MCLBYTES=1<<11, sys/sys/param.h:497); no clamp exists anywhere on the path, so ieee80211_input/ieee80211_input_all (rt2661.c:1132-1138) parse up to 2047 bytes past the cluster and can deliver them to the stack/userland (monitor capture, UDP payload) or panic parsers on garbage OOB fields. Device-gated (malicious/compromised NIC or DMA attack; a buggy NIC setting the 12-bit field above 2048 also qualifies). Not reproduced: no Ralink NIC on the audit guest (env.txt); if_ral.ko ships in /boot/kernel. rt2860 sibling knowns DF-3748..3753 do not cover rxeof length trust.",
  "exploit_chain": "device writes an RX descriptor with flags[27:16] in (2048,4095] and a short frame in the cluster -> m_len=m_pkthdr.len=N>2048 -> ieee80211_input parses headers/payload OOB past the 2KB cluster -> leaked kernel heap bytes travel as frame payload to userland (monitor mode capture / UDP) or crash net80211 parsers.",
  "evidence": "VERDICT.md (length/cluster math + path:line), trigger.c (hardware recipe), env.txt (no vendor 0x1814 on guest; if_ral.ko present), fix.diff (MCLBYTES clamp, git apply --check clean)",
  "kernel_refs": [
    "sys/dev/netif/ral/rt2661.c:1101",
    "sys/dev/netif/ral/rt2661.c:1102",
    "sys/dev/netif/ral/rt2661.c:1055",
    "sys/dev/netif/ral/rt2661.c:1129",
    "sys/dev/netif/ral/rt2661.c:1132",
    "sys/dev/netif/ral/rt2661.c:1138",
    "sys/sys/param.h:497"
  ],
  "poc_changes": "No runnable PoC: needs RT2561/RT2661 hardware or a PCIe device emulator posting a crafted descriptor; trigger.c documents the on-hardware steps.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 6,
  "guest_dirty": 0,
  "build_cmd": "guest: cd /usr/src/sys/dev/netif/ral && patch -p1 < fix.diff && make   # after make obj",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -lv | grep -iE \"ralink|1814\"; ls -la /boot/kernel/if_ral.ko",
  "code_hash": "80041520617f9d9e80abe48792c9f0232aea09a89cb8790c7a2389ed62257dac",
  "notes": "Pass-2 finding, checklist item (a). Sibling rt2560.c shares the pattern (not audited here). FreeBSD-inherited code (same expression upstream).",
  "recommended_fix": "Clamp the device-fed length to MCLBYTES before handing the mbuf to ieee80211_input (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff clamps the finalized m_len/m_pkthdr.len to MCLBYTES; git apply --check clean. Runtime validation impossible without the NIC fix.diff applied to the guest /usr/src copy and the if_ral.ko module rebuilt clean with -Werror (build.log; combined with the other two rt2661 fix.diffs of this batch); runtime validation still impossible without the NIC.",
  "fix_evidence": "fix.diff; fix.diff applied to the guest /usr/src copy and the if_ral.ko module rebuilt clean with -Werror (build.log; combined with the other two rt2661 fix.diffs of this batch); runtime validation still impossible without the NIC."
}