DF-1020 — fw_bus_explore_callback unconditional OOB csrrom write

Build

./build.sh

(or: cc -o harness harness.c)

Run

./run.sh

(or: ./harness)

Expected output

The harness demonstrates that ongoaddr (16-bit bitfield) wraps via csrreg->val*4 (24-bit device-controlled), and the write at firewire.c:1500 occurs BEFORE the bounds check at :1558.

Preconditions (for runtime trigger)

• A FireWire controller present (to enable bus exploration).
• A malicious FireWire device responding with crafted Config ROM.
• This QEMU guest has NO FireWire hardware — source-level only.

Fix

fix.diff — move the bounds check (ongoaddr - CSRROMOFF) >= CSRROMSIZE to BEFORE the write at firewire.c:1500.

DF-1020 — fw_bus_explore_callback unconditional OOB csrrom write — VERDICT

Verdict: INCONCLUSIVE (runtime) / CONFIRMED (source-level)

The bug is confirmed real by line-by-line source tracing. Runtime reproduction is blocked by missing FireWire hardware (no controller, no /dev/fw* on this guest).

Mechanism (source-level trace)

1. Code location: fw_bus_explore_callback() in sys/bus/firewire/firewire.c:1494-1561 (the else branch for Config ROM exploration responses).

2. Unconditional write before bounds check: - Line 1500 (WRITE): fc->ongodev->csrrom[(fc->ongoaddr - CSRROMOFF)/4] = ntohl(rfp->mode.rresq.data); - Line 1558 (CHECK — too late): if((fc->ongoaddr - CSRROMOFF) > CSRROMSIZE) goto nextnode;

3. ongoaddr wrapping: At line 1513-1520: c csrreg = (struct csrreg *)&fc->ongodev->csrrom[(fc->ongoaddr - CSRROMOFF)/4]; if (csrreg->key == 0x81 || csrreg->key == 0xd1) { csrd->ongoaddr = fc->ongoaddr; fc->ongoaddr += csrreg->val * 4; // val is 24-bit device-controlled - csrreg->val (iec13213.h:129): u_int32_t val:24 — device-controlled. - fc->ongoaddr (firewirereg.h:107-109): u_int32_t ... ongoaddr:16 — a 16-bit bitfield that truncates on overflow. - val * 4 can be up to 0xFFFFFF * 4 = 0x3FFFFFC, wrapping the 16-bit ongoaddr to any value.

4. OOB write: After wrapping, the next call to fw_bus_explore sends a new read request. The response hits line 1500, writing to csrrom[(wrapped_ongoaddr - CSRROMOFF)/4]. If ongoaddr < CSRROMOFF, the unsigned subtraction produces a massive index → write far past csrrom[256].

5. Target struct layout (struct fw_device, firewirereg.h:44-62): csrrom[256] (1024 bytes) | rcnt (4) | *fc (8, KERNEL POINTER) | status (4) | STAILQ link (8) | adjacent heap Overwriting *fc (kernel pointer to firewire_comm) gives RIP control when the corrupted pointer is later dereferenced.

Exploit chain

This is a device-attacker exploit: a malicious FireWire device on the bus responds to exploration reads with crafted Config ROM. The OOB write corrupts the fw_device struct (kernel pointer, linked list pointers, status). Combined with FW_GCROM info leak (KASLR defeat), this yields arbitrary kernel write → potential RIP control.

Not a local user exploit — requires physical/bus access to a FireWire controller with a malicious device.

Why runtime reproduction is blocked

• No FireWire controller on this QEMU guest.
• /dev/fw* nodes don't exist.
• The firewire driver is compiled into GENERIC but not active.
• The bus exploration callback only fires when a FireWire controller initiates node discovery — impossible without HW.

PoC changes

Created harness.c — demonstrates ongoaddr 16-bit bitfield wrapping arithmetic and the order-of-operations bug (write before bounds check). Built and verified on the guest.

Fix validation

The fix (fix.diff) moves the bounds check BEFORE the write:

if ((fc->ongoaddr - CSRROMOFF) >= CSRROMSIZE)
    goto nextnode;
fc->ongodev->csrrom[...] = ntohl(rfp->mode.rresq.data);

Applied + compiled in combined-fix kernel (#1, rc=0, boots cleanly). Runtime before/after not possible (no FireWire HW).

fix_status: not_testable (diff applies + compiles; runtime blocked by missing HW).

Recommended fix

Move the bounds check (ongoaddr - CSRROMOFF) >= CSRROMSIZE to BEFORE the write at line 1500 (currently the check is at line 1558, after the write). This matches the finding proposal. Additionally, consider capping csrreg->val at a sane maximum to prevent 16-bit wrapping of ongoaddr.