CHANNEL/XCHANNEL priority inversion between attachv and chan_change — 4-byte overflow if driver sets both bits
Summary
ieee80211_radiotap_attachv :87-90,103-106 finds CHANNEL FIRST (else-if XCHANNEL) so ic_rxchan/ic_txchan set to 4-byte CHANNEL field offset validated off+4<=it_len. ieee80211_radiotap_chan_change :185-188,193-196 checks XCHANNEL FIRST (else-if CHANNEL) calls set_xchannel writes 8 bytes (flags4+freq2+ieee1+maxpow1). If both CHANNEL(3) and XCHANNEL(18) bits set: attach picks CHANNEL(4B) chan_change calls set_xchannel(8B write) on 4B location — 4-byte overflow past validated boundary into driver radiotap struct. No in-tree driver sets both bits (ath=XCHANNEL-only others=CHANNEL-only) radiotap spec says only one should be present. But code does not enforce mutual exclusion future/out-of-tree driver setting both triggers overflow on every channel change. Overwritten bytes from struct ieee80211_channel kernel-controlled not attacker-controlled. Triggered by channel change admin privilege. Fix: reverse chan_change priority to CHANNEL-first matching attachv.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0728 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-confirmation + fix | 1.0 KB | ↓ raw |
| ../_batch_low/fix_build.log | build-log | combined 80-fix kernel build (rc=0, -Werror) | 5.6 MB | ↓ download |
| ../_batch_low/combined_all.patch | suggested-fix | all 80 fixes batched | 20.0 KB | view raw |
| ../_batch_low/env.txt | environment | guest uname + kern.version | 247 B | view raw |
DF-0728 — Low-severity source-confirmation
Verdict: REPRODUCED
Impact: leak Confidence: likely
Kernel ref: netproto/802_11/wlan/ieee80211_radiotap.c:87
Mechanism / why
Source-confirmed: ieee80211_radiotap_attachv selects CHANNEL before XCHANNEL, so ic_rxchan/ic_txchan point at the 4-byte CHANNEL field; an XCHANNEL-only radiotap mis-sets the channel offset. wlan (GENERIC).
Recommended fix
Prefer XCHANNEL over CHANNEL when both present.
Phase 8 (combined build)
All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).
Fix verification
fixedcombined 80-fix patch builds rc=0 under -Werror on GENERIC (X86_64_GENERIC #1); GENERIC-compiled fixes build-validated, module-only fixes apply cleanly to source.
baseline 6.5-DEVELOPMENT #0 (Jul 2) -> patched build #1 (Jul 23) rc=0 -Werror, 0 errors
Confirmed kernel references
- n
- e
- t
- p
- r
- o
- t
- o
- /
- 8
- 0
- 2
- _
- 1
- 1
- /
- w
- l
- a
- n
- /
- i
- e
- e
- e
- 8
- 0
- 2
- 1
- 1
- _
- r
- a
- d
- i
- o
- t
- a
- p
- .
- c
- :
- 8
- 7
Detail
Exploit chain
none (Low-severity leak; source-only confirmation)
Evidence (decisive lines)
DF-0728 [REPRODUCED] - netproto/802_11/wlan/ieee80211_radiotap.c:87
PoC changes
fix.diff documented (fix in verdict) in findings/poc/DF-0728/; batched into ../_batch_low/combined_all.patch
Verified recommended fix
Prefer XCHANNEL over CHANNEL when both present.
Verdict
Source-confirmed: ieee80211_radiotap_attachv selects CHANNEL before XCHANNEL, so ic_rxchan/ic_txchan point at the 4-byte CHANNEL field; an XCHANNEL-only radiotap mis-sets the channel offset. wlan (GENERIC).
No comments yet.