⬢ DragonFlyBSD Kernel Audit
DF-5247 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5247",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Deferred cmdq callbacks hold raw vap/node pointers that are not drained on vap destruction: ieee80211_vap_detach() drains only iv_nstate_task/iv_swbmiss_task (ieee80211.c:775-778), while run_vap_delete() (if_run.c:997-1031) kfrees rvp with sc->cmdq_task possibly still holding run_update_beacon/run_key_set/run_newassoc/tx-timeout entries pointing at it. The pending task then executes on freed heap (run_update_beacon_cb 4904-4952, run_key_set_cb 2237-2352, run_newassoc_cb 2625-2639). Ordering demonstrated deterministically by vap_lifetime.c on the guest; in-kernel repro hardware-gated -> inconclusive.",
  "exploit_chain": "queue beacon/key/assoc cmdq entry (hostapd + remote peer activity) -> ifconfig wlanX destroy -> kfree(run_vap) + heap reuse -> cmdq task dereferences freed vap (read + device register writes derived from freed memory) -> kernel UAF; needs privileged destroy to arm, primarily reliability/corruption impact",
  "evidence": "findings/poc/DF-5247/run.log: UAF observed: deferred callback dereferenced freed run_vap; ieee80211.c:775-778 drain list vs if_run.c:879-880 (cmdq drained only at device detach)",
  "kernel_refs": [
    "sys/bus/u4b/wlan/if_run.c:4894",
    "sys/bus/u4b/wlan/if_run.c:2368",
    "sys/bus/u4b/wlan/if_run.c:2669",
    "sys/bus/u4b/wlan/if_run.c:3157",
    "sys/bus/u4b/wlan/if_run.c:997",
    "sys/bus/u4b/wlan/if_run.c:1030",
    "sys/bus/u4b/wlan/if_run.c:879",
    "sys/netproto/802_11/wlan/ieee80211.c:775"
  ],
  "poc_changes": "Harness written from scratch (no seed); ordering demo",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o /tmp/vap_lifetime /tmp/vap_lifetime.c",
  "run_cmd": "/tmp/vap_lifetime",
  "code_hash": "338ca96fef48e9be2081f70160297ef7c173671509d90a7afefa4c0d61b8ff87",
  "notes": "Window is wide (vap teardown is slow) relative to taskqueue latency.",
  "recommended_fix": "Drain sc->cmdq_task and sc->ratectl_task in run_vap_delete() before kfree(rvp)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and verified with git apply --check against the pristine sys/ tree, but cannot be kernel-tested: the QEMU guest has no USB controller and no run(4) device model exists, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.",
  "fix_evidence": "fix.diff (git-apply clean); VERDICT.md"
}