DF-0348
Missing m_pullup for management frames: no guarantee frame header contiguous
Summary
hostap_input TYPE_DATA gets m_pullup(:596-603). TYPE_MGT does NOT — only checks m_pkthdr.len not m_len. Chained mbuf with first seg <24 bytes -> wh=mtod reads past first mbuf. hostap_recv_mgmt efrm=mtod+m_len covers first mbuf only -> IEs in later mbufs missed. Defense-in-depth: most drivers coalesce RX frames.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0348 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 408 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netproto/802_11/wlan/ieee80211_hostap.c:594: missing m_pullup for management frames
Verified recommended fix
Source-confirmed at sys/netproto/802_11/wlan/ieee80211_hostap.c:594: missing m_pullup for management frames
Verdict
Source-confirmed at sys/netproto/802_11/wlan/ieee80211_hostap.c:594: missing m_pullup for management frames
No comments yet.