⬢ DragonFlyBSD Kernel Audit
DF-4712 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-4712",
  "verdict": "untested (runtime) - hardware-gated: no Atheros NIC on guest; source-confirmed latent OOB via signed q; fix build-validated nativekernel rc=0",
  "impact": "latent kernel OOB read/write below ah_txq[10] + unchecked MMIO if an unvalidated queue index is ever passed; no unprivileged trigger today",
  "confidence": "certain",
  "reproduce": {
    "build": "guest# cd /usr/src && patch -p1 < /tmp/df4712_fix.diff && make nativekernel KERNCONF=X86_64_GENERIC",
    "run": "n/a (no Atheros NIC on the audit guest; no userland-reachable caller - if_ath.c:4013-4032 validates every qnum)",
    "expected": "BUILD_RC=0 with -Werror; patched ar5211_xmit.o in kernel (build.log:7139); runtime behavior unchanged on ath-less hardware"
  },
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:84",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:89",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:100",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:105",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:405",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:415",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:435",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:458",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:480",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211.h:121",
    "sys/dev/netif/ath/ath_hal/ah.h:236",
    "sys/dev/netif/ath/ath_hal/ah_internal.h:665",
    "sys/dev/netif/ath/ath_hal/ah.c:951",
    "sys/dev/netif/ath/ath/if_ath.c:4013"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fix.diff", "build.log", "env.txt",
    "manifest.json", "verdict.json", "build.sh"
  ]
}