DF-0454 — PoC evidence pack

See VERDICT.md for the full analysis.

Files

• trigger source — the PoC program(s)
• build.sh — exact build command
• run.sh — exact run command
• fix.diff — git-apply-able fix for the verified bug
• VERDICT.md — full narrative: mechanism, evidence, fix validation
• manifest.json — machine-readable catalog
• env.txt — guest environment

Quick reproduce

./build.sh && ./run.sh

DF-0454 — rfcomm_session_recv_mcc_rpn uninitialized stack info leak

Verdict

REPRODUCED (source-confirmed) — the bug is real but not live-triggerable on this guest (no Bluetooth hardware / BT peer).

Mechanism

rfcomm_session_recv_mcc_rpn (sys/netbt/rfcomm_session.c:1212-1270) processes an RFCOMM Remote Port Negotiation command. When m->m_pkthdr.len == 1 (line 1230), only 1 byte is copied via m_copydata(m, 0, 1, &rpn) into the 8-byte struct rfcomm_mcc_rpn (line 1231). That single byte fills rpn.dlci (offset 0); bit_rate/line_settings/flow_control/xon_char/xoff_char (offsets 1-5) are pre-initialized by the defaults at lines 1221-1225. But rpn.param_mask (offsets 6-7, a uint16_t) is NEVER written in this branch.

Line 1232 then reads rpn.param_mask = letoh16(rpn.param_mask) — 2 uninitialized stack bytes. Lines 1240-1265 compute mask from the uninitialized param_mask bits (the value checks always pass because the other fields are RFCOMM defaults). Line 1269 sends the full 8-byte rpn struct to the remote peer via rfcomm_session_send_mcc. The attacker recovers up to ~7 bits of kernel stack per request from the response param_mask.

Threat model

Unauthenticated remote Bluetooth peer sends a 1-byte RPN MCC request and observes the param_mask bits in the response. Requires an active BT HCI transport attached to the netbt stack.

Why not live-triggered on this guest

The QEMU/KVM audit guest has no Bluetooth hardware and no virtual BT HCI. Loading netbt.ko creates the net.bluetooth.* sysctl tree and the BT socket domain, but cannot receive RFCOMM frames without a lower-layer HCI driver. The bug is confirmed by source inspection of rfcomm_session.c:1227-1232 and the struct layout in rfcomm.h:179-188 (8-byte __packed__ struct; param_mask at bytes 6-7).

PoC

df0454_model.c — a userspace model that replicates the exact struct layout and code path, demonstrating that param_mask is never written in the len==1 branch.

Fix

fix.diff — add memset(&rpn, 0, sizeof(rpn)) before the defaults so param_mask is zeroed. Validated by building the fixed netbt.ko (compiles cleanly; runtime not testable without BT HW).

Build / Run

cc -o df0454_model df0454_model.c
./df0454_model