DF-0654 — ccmp_setkey omits AES key load for software-decrypt-only CCMP keys

Verdict: BUG CONFIRMED REAL by source trace — not runnable on guest (no WiFi hardware); impact ceiling = deterministic kernel panic (DoS)

Bug summary (source-confirmed)

ccmp_setkey() (sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:130) loads the AES key schedule only when IEEE80211_KEY_SWENCRYPT (0x0010) is set:

129  static int
130  ccmp_setkey(struct ieee80211_key *k)
...
134      if (k->wk_keylen != (128/NBBY)) { ... return 0; }
140      if (k->wk_flags & IEEE80211_KEY_SWENCRYPT)            // <-- gates ONLY on SWENCRYPT
141          rijndael_set_key(&ctx->cc_aes, k->wk_key, k->wk_keylen*NBBY);
142      return 1;
143  }

But ccmp_decap() calls ccmp_decrypt() when IEEE80211_KEY_SWDECRYPT (0x0020) is set (ieee80211_crypto_ccmp.c:266-268), and ccmp_decrypt() → ccmp_init_blocks() → rijndael_encrypt() uses the same ctx->cc_aes.

ccmp_attach() (:97-104) allocates the context with M_ZERO, so if a key is configured SWDECRYPT without SWENCRYPT, ccmp_setkey skips rijndael_set_key and cc_aes stays zeroed: Nr == 0, ek[]/dk[] all zero.

In rijndaelEncrypt() (sys/crypto/rijndael/rijndael-alg-fst.c:862), with Nr=0:

946   rk += Nr << 2;        // rk unchanged
951   r = Nr >> 1;          // r = 0
952   for (;;) {
953       ... read rk[4..7]; rk += 8;
979       if (--r == 0) break;   // --r => -1, NEVER == 0 -> loop never breaks
...

--r makes r == -1 (never 0), so the loop never terminates; rk += 8 each iteration walks rk past ek[60], dk[60], out of the ccmp_ctx and into adjacent kernel heap. The Te0[(s0>>24)] lookups index on out-of-bounds memory and rk[] reads eventually hit an unmapped page → fatal page fault.

This fault occurs inside ccmp_init_blocks() (CBC-MAC block construction) before any MIC check, so an attacker need only deliver a single privacy-bit-set 802.11 data frame (>=32 B) to a BSS/STA whose driver configures CCMP SWDECRYPT-only.

Reachability of the SWDECRYPT-without-SWENCRYPT config

ieee80211_crypto.c::ieee80211_crypto_newkey(): - :320-325 — if the hardware lacks the cipher, it sets both SWCRYPT bits (flags |= IEEE80211_KEY_SWCRYPT), so the AES key IS loaded — NOT the vulnerable case. - :386-410 — the driver-flag override path: after dev_key_alloc(), if the driver changed wk_flags (e.g. a driver doing HW-encrypt / SW-decrypt asymmetric offload), the cipher context is re-attached with the driver's flags. A driver that clears SWENCRYPT while keeping SWDECRYPT yields the vulnerable state where ccmp_setkey skips the key load but ccmp_decap still decrypts.

So the buggy state is reachable via the framework's driver-override path; whether it manifests depends on a driver setting SWDECRYPT-without-SWENCRYPT (uncommon but within the framework's design — asymmetric crypto offload).

Reproduction

Not runnable on this guest: there is no WiFi hardware / ieee80211 VAP, so the CCMP cipher is never attached and ccmp_setkey/ccmp_decap cannot be invoked. This is a source/logic finding verified by code trace + the mathematically-certain rijndaelEncrypt Nr=0 runaway-loop argument. (The #else /* !FULL_UNROLL */ branch at rijndael-alg-fst.c:947 is the one compiled by the DragonFly build.)

Fix

Gate the AES key load on IEEE80211_KEY_SWCRYPT (= SWENCRYPT|SWDECRYPT) so the key schedule is loaded whenever EITHER software path is used (fix.diff):

-   if (k->wk_flags & IEEE80211_KEY_SWENCRYPT)
+   if (k->wk_flags & IEEE80211_KEY_SWCRYPT)
        rijndael_set_key(&ctx->cc_aes, k->wk_key, k->wk_keylen*NBBY);

Matches the finding proposal (gate on SWCRYPT). IEEE80211_KEY_SWCRYPT is defined at sys/netproto/802_11/ieee80211_crypto.h:107-108.

Kernel references

• sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:130-143 — ccmp_setkey
• sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:140 — gates on SWENCRYPT only
• sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:266-268 — ccmp_decap decrypts on SWDECRYPT
• sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:104 — ccmp_attach M_ZERO (Nr=0)
• sys/crypto/rijndael/rijndael-alg-fst.c:946-981 — rijndaelEncrypt Nr=0 runaway loop
• sys/netproto/802_11/wlan/ieee80211_crypto.c:320-325,386-410 — flag set / driver-override paths
• sys/netproto/802_11/ieee80211_crypto.h:82,83,107 — SWENCRYPT/SWDECRYPT/SWCRYPT