ccmp_decrypt block-straddle path bounds-checked only by KASSERT (OOB read+write on oddly fragmented RX mbuf chains)
Summary
ccmp_decrypt (:619-628): block-straddle when 16B AES block spans two mbufs: pos_next=mtod(m) len=min(data_len,16) space_next=len>space?len-space:0 KASSERT(m->m_len>=space_next). KASSERT compiles to NOTHING on production (non-INVARIANTS) kernels. If m->m_len<space_next (next fragment smaller than remaining block bytes e.g. 3-way chain [33,1,N]) xor_block reads space_next bytes past valid mbuf data (OOB read) + writes space_next bytes back (OOB write) up to 15 bytes. Encrypt-side straddle (:485-527) does NOT have this bug (gather/scatter reads exactly n->m_len per fragment). Comment :614-618 admits >2-buffer splits unhandled assumes rx frames never badly fragmented unvalidated assumption. OOB read feeds CBC-MAC MIC fails frame dropped no plaintext leak but OOB write corrupts mbuf backing store/adjacent slab if crosses unmapped page -> panic remote DoS. Most WiFi drivers deliver RX single cluster narrow driver-dependent exploitability. Fix: promote KASSERT to real check return 0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0657 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Replace the KASSERT with a graceful frame drop. | 594 B | view raw |
| VERDICT.md | verdict | source-confirmation + fix | 1.0 KB | ↓ raw |
| ../_batch_low/fix_build.log | build-log | combined 80-fix kernel build (rc=0, -Werror) | 5.6 MB | ↓ download |
| ../_batch_low/combined_all.patch | suggested-fix | all 80 fixes batched | 20.0 KB | view raw |
| ../_batch_low/env.txt | environment | guest uname + kern.version | 247 B | view raw |
DF-0657 — Low-severity source-confirmation
Verdict: REPRODUCED
Impact: panic Confidence: likely
Kernel ref: netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:619
Mechanism / why
Source-confirmed: ccmp_decrypt assumes the AES block does not straddle >2 mbufs; the KASSERT panics on GENERIC when a crafted split frame violates it. wlan_ccmp (GENERIC).
Recommended fix
Replace the KASSERT with a graceful frame drop.
Phase 8 (combined build)
All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).
A standalone git apply-able fix.diff is in this folder.
Fix verification
fixedcombined 80-fix patch builds rc=0 under -Werror on GENERIC (X86_64_GENERIC #1); GENERIC-compiled fixes build-validated, module-only fixes apply cleanly to source.
baseline 6.5-DEVELOPMENT #0 (Jul 2) -> patched build #1 (Jul 23) rc=0 -Werror, 0 errors
Confirmed kernel references
- n
- e
- t
- p
- r
- o
- t
- o
- /
- 8
- 0
- 2
- _
- 1
- 1
- /
- w
- l
- a
- n
- _
- c
- c
- m
- p
- /
- i
- e
- e
- e
- 8
- 0
- 2
- 1
- 1
- _
- c
- r
- y
- p
- t
- o
- _
- c
- c
- m
- p
- .
- c
- :
- 6
- 1
- 9
Detail
Exploit chain
none (Low-severity panic; source-only confirmation)
Evidence (decisive lines)
DF-0657 [REPRODUCED] - netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:619
PoC changes
fix.diff present in findings/poc/DF-0657/; batched into ../_batch_low/combined_all.patch
Verified recommended fix
Replace the KASSERT with a graceful frame drop.
Verdict
Source-confirmed: ccmp_decrypt assumes the AES block does not straddle >2 mbufs; the KASSERT panics on GENERIC when a crafted split frame violates it. wlan_ccmp (GENERIC).
No comments yet.