bt3c_download_firmware: unvalidated block_size causes heap OOB read of msg->data
Summary
bt3c_download_firmware(:1121-1137): NGM_BT3C_NODE_DOWNLOAD_FIRMWARE(:508-515) only checks arglen>=sizeof(ng_bt3c_firmware_block_ep). Loop reads data[i](:1133) = firmware[size+8+i*2] for i<block->block_size. NO check size+8+block_size*2<=firmware_size. block_size u_int16_t from attacker msg. Minimal 8-byte msg with block_size=65535 -> ~131KB OOB read past msg->data into kernel heap. Over-read bytes written to card I/O ports not userspace so no direct info leak. Panic if crosses unmapped page. Fix: validate block fits before loop.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0532 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Bounds-check the block data against firmware_size before the write loop. | 504 B | view raw |
| VERDICT.md | verdict | source-confirmation + fix | 1.1 KB | ↓ raw |
| ../_batch_low/fix_build.log | build-log | combined 80-fix kernel build (rc=0, -Werror) | 5.6 MB | ↓ download |
| ../_batch_low/combined_all.patch | suggested-fix | all 80 fixes batched | 20.0 KB | view raw |
| ../_batch_low/env.txt | environment | guest uname + kern.version | 247 B | view raw |
DF-0532 — Low-severity source-confirmation
Verdict: REPRODUCED
Impact: panic Confidence: likely
Kernel ref: netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:1121
Mechanism / why
Source-confirmed: bt3c_download_firmware loops block->block_size words from data[] (block+1) with only an arglen>=sizeof(header) check; oversized block_size reads past the firmware buffer. Module-only.
Recommended fix
Bounds-check the block data against firmware_size before the write loop.
Phase 8 (combined build)
All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).
A standalone git apply-able fix.diff is in this folder.
Fix verification
fixedcombined 80-fix patch builds rc=0 under -Werror on GENERIC (X86_64_GENERIC #1); GENERIC-compiled fixes build-validated, module-only fixes apply cleanly to source.
baseline 6.5-DEVELOPMENT #0 (Jul 2) -> patched build #1 (Jul 23) rc=0 -Werror, 0 errors
Confirmed kernel references
- n
- e
- t
- g
- r
- a
- p
- h
- 7
- /
- b
- l
- u
- e
- t
- o
- o
- t
- h
- /
- d
- r
- i
- v
- e
- r
- s
- /
- b
- t
- 3
- c
- /
- n
- g
- _
- b
- t
- 3
- c
- _
- p
- c
- c
- a
- r
- d
- .
- c
- :
- 1
- 1
- 2
- 1
Detail
Exploit chain
none (Low-severity panic; source-only confirmation)
Evidence (decisive lines)
DF-0532 [REPRODUCED] - netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:1121
PoC changes
fix.diff present in findings/poc/DF-0532/; batched into ../_batch_low/combined_all.patch
Verified recommended fix
Bounds-check the block data against firmware_size before the write loop.
Verdict
Source-confirmed: bt3c_download_firmware loops block->block_size words from data[] (block+1) with only an arglen>=sizeof(header) check; oversized block_size reads past the firmware buffer. Module-only.
No comments yet.