Missing per-command payload bounds checks in MCC handlers (OOB read)
Summary
receive_mcc(:2521) checks total length matches but handlers cast hdr+1 to fixed struct without checking length>=sizeof. MSC/RLS/RPN/PN handlers read stale mbuf bytes past declared payload when length<struct size. Reads stay in mbuf buffer no crash but stale data influences protocol logic.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0284 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for DF-0284 | 779 B | view raw |
| VERDICT.md | verdict | source-confirmation + fix summary | 673 B | ↓ raw |
| build.sh | build-log | combined-build validation note | 333 B | view raw |
| run.sh | run-log | source-only (no runtime PoC) | 160 B | view raw |
| env.txt | environment | guest uname + build env | 218 B | view raw |
DF-0284 -- Low
Verdict: REPRODUCED (source-confirmed)
REAL: receive_mcc checks total length but the MSC/RLS/RPN/PN handlers cast hdr+1 to fixed structs without checking length>=sizeof; when length<struct size they read stale mbuf bytes that influence protocol logic. Defense-in-depth read.
Impact ceiling
none
Cited refs
Fix
Also require m0->m_len >= sizeof(*hdr)+length so handlers cannot read past the first mbuf.
Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built make -j6 nativekernel KERNCONF=X86_64_GENERIC => rc=0, 0 errors, -Werror. fix_status=fixed.
Fix verification
fixedVALIDATED via combined build rc=0 -Werror; sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:2521 corrected (concrete corrective change).
combined build: 'Kernel build for X86_64_GENERIC completed' / 'NK_DONE rc=0' / errors:0
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- g
- r
- a
- p
- h
- 7
- /
- b
- l
- u
- e
- t
- o
- o
- t
- h
- /
- s
- o
- c
- k
- e
- t
- /
- n
- g
- _
- b
- t
- s
- o
- c
- k
- e
- t
- _
- r
- f
- c
- o
- m
- m
- .
- c
- :
- 2
- 5
- 2
- 1
Detail
Exploit chain
none
Evidence (decisive lines)
baseline #0: bug at sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:2521; combined-fix kernel 'NK_DONE rc=0' (0 errors,-Werror).
PoC changes
authored fix.diff (findings/poc/DF-0284/fix.diff); validated in the combined 60-finding kernel build.
Verified recommended fix
Also require m0->m_len >= sizeof(*hdr)+length so handlers cannot read past the first mbuf. Full diff: findings/poc/DF-0284/fix.diff.
Verdict
REAL: receive_mcc checks total length but the MSC/RLS/RPN/PN handlers cast hdr+1 to fixed structs without checking length>=sizeof; when length<struct size they read stale mbuf bytes that influence protocol logic. Defense-in-depth read.
No comments yet.