⬢ DragonFlyBSD Kernel Audit
DF-4687 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4687",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED on the DragonFly guest by compiling the verbatim kernel function bodies (anchor-extracted ar2425.c:246-494 from /usr/src, md5-verified == audit tree) against a faithful ar2425State layout (bank rows 1/1/1/29/3 from the shipped ar5212.ini; verified offsets pcdac@72 Bank1@328 Bank6@340 Bank7@456, sizeof 472 incl. tail padding): with an EEPROM-shaped crafted dataset (xpd_mask=0xF, Pmin pattern {0,58,58,58}, TPCRG5 overlap 15 -- register-realistic, the field is 4 bits) the unbounded kk walk at ar2425.c:452/:462/:473 wrote uint16 cells past pcdacTable[PWR_TABLE_SIZE_2413=128] into the Bank1Data..Bank7Data members of the ath_hal_mallocd ar2425State object (intra-object overflow; kk ran to 173, last byte 89 past the array end; RF bank scratch corrupted, reprogrammed to the radio at ar2425.c:200-210). Fully EEPROM-feasible: each pd-gain span of 40-60 half-dB is constructor-legal, four gains sum past 128 by construction. Exploitation is gated on attacker-supplied AR2425/AR2417 hardware with crafted EEPROM (physical/supply-chain); realistic ceiling is radio misprogramming/crash, not privilege escalation. Twin of DF-4619 (ar5413) / DF-4648 (ar2316) / DF-4660 (ar2413) / DF-4680 (ar2317). Fix validated: with kk<PWR_TABLE_SIZE_2413 guards the overflow is gone (bank canary intact).",
  "exploit_chain": "crafted-EEPROM AR2425 card -> ath attach -> ar2425SetPowerTable (channel set/reset) -> ar2425getGainBoundariesAndPdadcsForPowers -> OOB write/wild read; ceiling radio misprogramming/panic (DoS), not uid0",
  "evidence": "run.log: DF-4687 REPRODUCED ... first clobbered u16 cell 0 bytes past array end, last 89 bytes past (value 0x007f) => kk ran to 173; fix_run.log: PATCHED mode 1 ... DF-4687: NO overflow detected.",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:452",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:462",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:473",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:38",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:710",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_v3.h:282"
  ],
  "poc_changes": "ar2425-specific harness (vs DF-4680 template): the 5 function-scope static declarations (ar2425.c:367-379) are stripped from the verbatim extraction (asserted count) and re-bound to a guarded mmap block emulating kernel static storage -- ar2425 keeps the VpdTable/Pmin/Pmax scratch in .bss, not in ar2425State like the family twins; first build attempt had a macro/field name collision (offsetof) fixed by m_-prefixing the emulation fields; guest tar transfer ordering bug fixed (extract before overwrite)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cd /root/df2425 && sh build.sh",
  "run_cmd": "cd /root/df2425 && sh run.sh",
  "code_hash": "636b2f3246c5e050c9c9e816348aa7314701607074df491027ffb367edd7c101",
  "notes": "hardware-gated (no AR2425 NIC on guest); verbatim-extraction methodology identical to accepted siblings DF-4619/4620/4622/4648/4649/4650/4660/4661/4662/4680/4681/4682/4683",
  "recommended_fix": "Bound all three pdadc write loops with kk < PWR_TABLE_SIZE_2413 (fixA).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Harness-level validation (fix_validate.sh): baseline mode 1 clobbers bank cells 0..89 bytes past pcdacTable[127] (kk=173); with fixA (kk < PWR_TABLE_SIZE_2413 in all three loops) mode 1 reports NO overflow detected and the 0xAAAA canary is intact. No kernel rebuild: no AR2425 hardware on the guest; validated against verbatim-extracted bodies per family methodology.",
  "fix_evidence": "run.log: DF-4687 REPRODUCED ... first clobbered u16 cell 0 bytes past array end, last 89 bytes past (value 0x007f) => kk ran to 173; fix_run.log: PATCHED mode 1 ... DF-4687: NO overflow detected."
}