⬢ DragonFlyBSD Kernel Audit
DF-4680 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4680",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "cd /root/df2317 && sh build.sh",
  "run_cmd": "./ar2317_harness 1",
  "code_hash": "2a6f1714d2a77176c8c164e7a8ea4dd9153f22a3bdecb466c9af8ded31a0d901",
  "verdict": "REPRODUCED on the DragonFly guest (verbatim-extraction harness, mode 1): with an EEPROM-shaped crafted dataset (xpd_mask=0xF, Pmin pattern {0,58,58,58}, TPCRG5 overlap 15 -- register-realistic, the field is 4 bits, ar5212phy.h:349) the unbounded kk walk at ar2317.c:434/:443/:457 wrote 40 uint16 cells (80 bytes) past pcdacTable[PWR_TABLE_SIZE_2317=128] into the Bank1Data..Bank7Data members of the heap-allocated ar2317State object (intra-object overflow; RF bank scratch corrupted, reprogrammed to the radio at ar2317.c:190-194). kk ran to 168; with 63-clamped boundaries and overlap 15 the minimum-guaranteed walk is 3+63+6*15=156 > 128. Exploitation is gated on attacker-supplied AR2317 hardware with crafted EEPROM (physical/supply-chain); realistic ceiling is radio misprogramming/DoS, not privilege escalation. Twin of DF-4619 (ar5413) / DF-4648 (ar2316) / DF-4660 (ar2413). Fix validated: with kk<PWR_TABLE_SIZE_2317 guards the overflow is gone (bank canary intact, fix_run.log).",
  "exploit_chain": "crafted v3 EEPROM on AR2317 card -> ath attach reads ee_rawDataset2413 -> ar5212SetTransmitPower (ar5212_reset.c:2006-2036) -> ar2317SetPowerTable:513-515 -> ar2317getGainBoundariesAndPdadcsForPowers unbounded kk walk -> 80-byte intra-object heap OOB write past pcdacTable[128] into RF bank scratch -> banks programmed to radio (ar2317.c:190-194): radio misprogramming / crash. No uid0 route (values clamped 0..127, intra-object only).",
  "evidence": "run.log mode 1: DF-4680 REPRODUCED ... kk ran to 168; build.log struct offsets (pcdac@72 Bank1@328 vpdTable_L@472 sizeof 2008); fix_run.log patched mode 1: NO overflow detected; fix.diff (git-apply verified vs sys/).",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:432-436",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:442-443",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:452-461",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:41",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:490",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:729",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:190-194",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_v3.h:282"
  ],
  "poc_changes": "Harness ported from the DF-4660 (ar2413) twin: bank row counts 1/1/1/30/3 (ar5212.ini ar5212Bank*_2317), ar2317 names/anchors, 72-cell bank canary window, ar2317.c:35-37 typedef aliases added ahead of the extraction, object placed at a page end with a guard page (shared with modes 4/5 of DF-4683). No kernel-code changes -- function bodies compiled verbatim.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Validated on the guest: fix.diff (kk < PWR_TABLE_SIZE_2317 guards on all three pPDADCValues[kk++] loops) applied to a copy of the pristine guest ar2317.c, function bodies re-extracted verbatim from the patched copy, harness rebuilt and re-run. Baseline reproduces the overflow; patched build shows DF-4680: NO overflow detected (bank canary intact). fix.diff is git-apply-able against the pristine tree (git apply --check clean) and was never applied to sys/.",
  "fix_evidence": "fix_run.log (===== fixA section: PATCHES_APPLIED, FIXED_BUILD_OK, NO overflow detected) vs run.log mode 1; fix.diff in pack.",
  "attempts": 1,
  "notes": "Intra-object overflow only (stays inside the 2008-byte ath_hal_malloc allocation); values constrained (pdadc clamps 0/127). Known DF-1806 (numChannels==0 OOB read, pass 1) NOT re-reported. Sibling defects in the same function filed as DF-4681/DF-4682/DF-4683.",
  "recommended_fix": "Add kk < PWR_TABLE_SIZE_2317 guards to all three pPDADCValues[kk++] loops in ar2317getGainBoundariesAndPdadcsForPowers (fix.diff)."
}