Heap overflow in urtwn_efuse_read_data via crafted efuse extended header on RTL8188EU
Summary
urtwn_efuse_read at if_urtwn.c:1822-1834 RTL8188EU extended-header branch: off=(reg>>5)|(reg&0xf0)>>1; with reg=0xff -> off=127. Passed to urtwn_efuse_read_data which writes rom[off*8+i*2+{0,1}] for i in 0..3 -> max index 1023. struct r88e_rom=512B, union urtwn_rom=512B. size param only used for memset at :1817, never bounds the section writes. Off*8+7=1023 overflows 512B past sc->rom into sc->sc_mtx (driver lock), sc->cmdq[].func (function pointers invoked by urtwn_cmdq_cb :1606), sc_xfer[]. Malicious USB device (RTL8188EU VID/PID) triggers on plug-in via urtwn_attach->urtwn_r88e_read_rom->urtwn_efuse_read. Reliable panic; plausible kernel RCE via cmdq[].func overwrite. Fix: if((u32)off*8+7>=size) goto end.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0983 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| urtwn_efuse_harness.c | trigger-source | faithful userspace replication of urtwn_efuse_read/_data (VULNERABLE / -DFIXED) | 5.3 KB | view raw |
| build.sh | build-script | cc -O2 -Wall [-DFIXED] | 316 B | view raw |
| run.sh | run-script | runs vulnerable + fixed | 314 B | view raw |
| run.log | run-log | vulnerable: 8 bytes at rom+504..511 | 668 B | view raw |
| run_fixed.log | run-log | fixed: 0 OOB writes | 278 B | view raw |
| fix.diff | suggested-fix | bounds-check off against size in urtwn_efuse_read | 723 B | view raw |
| env.txt | environment | uname, cc, no USB devices | 432 B | view raw |
| fix_build.log | build-log | compile-validation: kernel+module build with fix applied, rc=0, no errors | 5.6 MB | ↓ download |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
Fix verification
fixedcompile+harness validated
see evidence pack
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
—
Verdict
REPRODUCED (harness). urtwn_efuse_read extended-header off=127 -> rom[1016..1023] 504B past 512B union. No USB HW.
No comments yet.