⬢ DragonFlyBSD Kernel Audit
DF-4527 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-4527",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Info-severity kernel-address disclosure, hardware-gated (no ath radio on the audit guest); Phase V skipped per policy for Info findings. Code trace: HAL_DIAG_ANI_CURRENT (ar5212_misc.c:1081-1085, reached from ar5416 via ar5416GetDiagState -> ar5212GetDiagState, ar5416_misc.c:557) exports sizeof(struct ar5212AniState) bytes of the internal per-channel ANI state; that structs LAST member is the kernel pointer const struct ar5212AniParams *params (ar5212.h:181-198), which ath_ioctl_diag() then copyout()s verbatim to userspace (if_ath_ioctl.c:214-219) \u2014 an 8-byte kernel heap address disclosure (offset of &ahp->ah_aniParams24/5 inside the ath_hal_5416 softc) on every SIOCGATHDIAG HAL_DIAG_ANI_CURRENT call. The exported HAL_ANI_STATE type in ah.h deliberately stops before the pointer; the diag path sizes the copy from the internal struct instead. Same ATH_DIAGAPI + missing-priv-check (DF-2059/DF-4320) gates as DF-4526; no KASLR on current DFly keeps impact informational.",
  "exploit_chain": "",
  "evidence": "code trace only (no pack; Info finding, skipped per Phase V policy)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_misc.c:1081-1085",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212.h:181-198",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_misc.c:530-557",
    "sys/dev/netif/ath/ath/if_ath_ioctl.c:214-219"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not applicable (skipped, Info)",
  "fix_evidence": "",
  "notes": "Fix: size the export from the exported type: *resultsize = offsetof(struct ar5212AniState, txFrameCount) (or sizeof of a sanitized snapshot struct) instead of sizeof(struct ar5212AniState).",
  "recommended_fix": "Copy out only the exported prefix of ar5212AniState (up to listenTime), not the full internal struct containing the params pointer."
}