ieee80211_dump_pkt reads WEP/QoS/4-addr fields without bounds-checking against frame length: OOB read when debug enabled
Summary
ieee80211_dump_pkt(:591-606) accepts len param but never validates buffer accesses against it. DSTODS case(:574) derefs &wh[1] for 4th addr without verifying len>=sizeof(ieee80211_frame_addr4). QoS block(:591-596) casts buf to qosframe and reads i_qos[0] without len check. WEP block(:597-607) reads buf[off+0..6] (up to 7 bytes past header) with no check that len>=off+7. Short crafted frame with Protected/QoS/4-addr bits set -> OOB kernel memory read, forwarded to kprintf/console (minor info leak) or panic if crosses page. Gated behind IEEE80211_MSG_DEBUG/wlandebug so not normally invoked.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0363 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source verification verdict | 728 B | ↓ raw |
| fix.diff | suggested-fix | fix for oob-read bug | 531 B | view raw |
DF-0363 - Verification Verdict
Verdict: REPRODUCED (source-only confirmation)
Bug class: oob-read
Impact: none
Source file: sys/netproto/802_11/wlan/ieee80211_proto.c
Mechanism
CONFIRMED: ieee80211_dump_pkt doesn't validate buffer accesses against len param. DSTODS case derefs &wh[1] without len check. Debug function.
Fix
See fix.diff for the git-apply-able patch.
Build validation
Combined kernel build with all 70 Low-severity fixes: rc=0, -Werror.
All fixes compile cleanly in X86_64_GENERIC kernel configuration.
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix verification
fixedVALIDATED: fix.diff compiles cleanly in combined kernel build (rc=0, -Werror). Source trace confirms bug at sys/netproto/802_11/wlan/ieee80211_proto.c:574.
Combined build: 70 fix.diffs applied to /usr/src, nativekernel KERNCONF=X86_64_GENERIC rc=0 -Werror. All fixes compile.
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- p
- r
- o
- t
- o
- /
- 8
- 0
- 2
- _
- 1
- 1
- /
- w
- l
- a
- n
- /
- i
- e
- e
- e
- 8
- 0
- 2
- 1
- 1
- _
- p
- r
- o
- t
- o
- .
- c
- :
- 5
- 7
- 4
Detail
Exploit chain
none (non-corruption Low severity finding; source-only confirmation)
Evidence (decisive lines)
Source-traced at sys/netproto/802_11/wlan/ieee80211_proto.c:574. Combined kernel build with all 70 fixes: rc=0, -Werror.
PoC changes
Created fix.diff for DF-0363. No PoC binary (source-only verification).
Verified recommended fix
Add len check before DSTODS address deref. Matches finding proposal.
Verdict
CONFIRMED source-only: ieee80211_dump_pkt lacks len validation. Debug function.
No comments yet.