⬢ DragonFlyBSD Kernel Audit
DF-4733 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-4733",
  "title": "ar5210_xmit: signed q<0 bypasses >=-only checks in ar5210Set/GetTxQueueProps down to ah_txq[3]; five exported xmit ops gate q only via inert HALASSERT (ar5210 twin of DF-4519/DF-4712)",
  "verdict": "untested-runtime (hardware-gated: no Atheros NIC on guest); fix build-validated BUILD_RC=0 -Werror",
  "impact": "latent kernel OOB read/write below ah_txq[3] via negative q; no in-tree unprivileged trigger",
  "reproduce": {
    "build": "cd /usr/src && patch -p1 < /tmp/df4733.diff && make nativekernel KERNCONF=X86_64_GENERIC",
    "run": "n/a (no Atheros NIC on guest; no userland-reachable caller)",
    "expected": "build-only: BUILD_RC=0, ar5210_xmit.c compiled -Werror"
  },
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:40",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:56",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:262",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:287",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:372",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:406",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:433",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210.h:96",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210.h:112",
    "sys/dev/netif/ath/ath_hal/ah_internal.h:669",
    "sys/dev/netif/ath/ath_hal/ah.c:951",
    "sys/dev/netif/ath/ath/if_ath.c:4013"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "build.sh", "build.log", "env.txt", "manifest.json", "verdict.json"]
}