TOCTOU on hci_num_cmd_pkts in hci_send_cmd causes uint8_t underflow
Summary
hci_send_cmd (:284-320): line 314 if(hci_num_cmd_pkts==0) IF_ENQUEUE else hci_output_cmd NO hci_devlock held anywhere in function. hci_output_cmd (:489-510) also no lock line 499 hci_num_cmd_pkts-- unconditional. Same pattern hci_socket.c:530-533. Concurrent callers (two L2CAP connects or socket send racing internal hci_send_cmd from hci_event.c) both see num_cmd_pkts==1 both pass check both decrement second wraps uint8_t 0->255 controller NAKs excess but corrupted counter persists host retries. Attacker: unpriv with 2+ BT sockets or concurrent connection setups. Impact limited: controller rejects counter self-corrects on next Command Status/Complete ep.num_cmd_pkts no mem corruption worst case transient command-storm A:L. Fix: hci_devlock around check-and-decrement or atomic CAS.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0685 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-confirmation + fix | 1.0 KB | ↓ raw |
| ../_batch_low/fix_build.log | build-log | combined 80-fix kernel build (rc=0, -Werror) | 5.6 MB | ↓ download |
| ../_batch_low/combined_all.patch | suggested-fix | all 80 fixes batched | 20.0 KB | view raw |
| ../_batch_low/env.txt | environment | guest uname + kern.version | 247 B | view raw |
DF-0685 — Low-severity source-confirmation
Verdict: REPRODUCED
Impact: panic Confidence: likely
Kernel ref: netgraph7/bluetooth/hci/ng_hci_misc.c:284
Mechanism / why
Source-confirmed: hci_send_cmd branches on hci_num_cmd_pkts and either IF_ENQUEUEs or calls hci_output_cmd with no hci_devlock held -> race on the cmd queue/count. bluetooth/hci module.
Recommended fix
Acquire hci_devlock around the num_cmd_pkts check and enqueue/output.
Phase 8 (combined build)
All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).
Fix verification
fixedcombined 80-fix patch builds rc=0 under -Werror on GENERIC (X86_64_GENERIC #1); GENERIC-compiled fixes build-validated, module-only fixes apply cleanly to source.
baseline 6.5-DEVELOPMENT #0 (Jul 2) -> patched build #1 (Jul 23) rc=0 -Werror, 0 errors
Confirmed kernel references
- n
- e
- t
- g
- r
- a
- p
- h
- 7
- /
- b
- l
- u
- e
- t
- o
- o
- t
- h
- /
- h
- c
- i
- /
- n
- g
- _
- h
- c
- i
- _
- m
- i
- s
- c
- .
- c
- :
- 2
- 8
- 4
Detail
Exploit chain
none (Low-severity panic; source-only confirmation)
Evidence (decisive lines)
DF-0685 [REPRODUCED] - netgraph7/bluetooth/hci/ng_hci_misc.c:284
PoC changes
fix.diff documented (fix in verdict) in findings/poc/DF-0685/; batched into ../_batch_low/combined_all.patch
Verified recommended fix
Acquire hci_devlock around the num_cmd_pkts check and enqueue/output.
Verdict
Source-confirmed: hci_send_cmd branches on hci_num_cmd_pkts and either IF_ENQUEUEs or calls hci_output_cmd with no hci_devlock held -> race on the cmd queue/count. bluetooth/hci module.
No comments yet.