DF-1131 — bwn DMA rxeof dr_rx_bufsize / cluster-size mismatch OOB read

Verdict

CONFIRMED (source-trace + harness) — INCONCLUSIVE on-guest (HW-gated). The bug is real; it cannot be triggered on the audit QEMU guest because the guest has no Broadcom BCM43xx (bwn) WiFi adapter (virtio net only).

Bug (one line)

bwn_dma_rxeof() checks frame_len against dr->dr_rx_bufsize (= BWN_DMA0_RX_BUFFERSIZE = IEEE80211_MAX_LEN = 2312) but the RX mbuf cluster is only MCLBYTES (2048), so a device-reported frame_len in (2018, 2312] passes the check yet makes m_len = len + dr_frameoffset exceed the 2048-byte cluster.

Mechanism (path:line)

• if_bwn.c:2778 — dr->dr_rx_bufsize = BWN_DMA0_RX_BUFFERSIZE; (BWN_DMA0_RX_BUFFERSIZE = IEEE80211_MAX_LEN; if_bwnreg.h:464).
• IEEE80211_MAX_LEN = 2300 + 4 + (3+1+4) = 2312 (ieee80211.h:1297); MCLBYTES = 2048.
• if_bwn.c:5674 — m = m_getcl(...) allocates an MCLBYTES (2048) cluster.
• if_bwn.c:5688 — m->m_len = m->m_pkthdr.len = MCLBYTES;
• if_bwn.c:5470 — len = le16toh(rxhdr->frame_len); (device-reported).
• if_bwn.c:5486 — if (len > dr->dr_rx_bufsize) checks against 2312, not 2048.
• if_bwn.c:5512 — m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset; (frameoffset=30) exceeds 2048 for len > 2018, but the cluster is only 2048 -> net80211 reads past the cluster when processing the frame.

Trigger / threat model

A malicious/rogue 802.11 frame (or a firmware bug) that makes the device report frame_len in (2018, 2312] is kept (it would be dropped only above 2312) and processed with an m_len larger than the cluster. net80211 then over-reads up to (2312+30-2048)=294 bytes of adjacent kernel heap; those bytes appear in the delivered frame payload (info leak) or hit an unmapped page (panic). Requires a Broadcom bwn adapter; attacker is within radio range.

Reproduction on the audit guest

Not possible — no bwn WiFi hardware. harness.c is a userspace replica of the length-check arithmetic, built and run as unprivileged maxx, proving the OOB and that the fix (drop when len + frameoffset > MCLBYTES) yields 0 OOB.

Build / run

./build.sh && ./run.sh

Expected: DF-1131: CONFIRMED heap OOB read primitive (up to 294 bytes past cluster) then DF-1131 FIX: VALIDATED - cluster-bound guard drops all overrun frames.

Fix

fix.diff adds (u_int)len + dr->dr_frameoffset > MCLBYTES to the existing drop check. Applies cleanly; compiles in the GENERIC kernel build (rc=0).

DF-1131 — VERDICT

Verdict: CONFIRMED via source-trace + userspace harness. On-guest: INCONCLUSIVE (HW-gated — no Broadcom bwn WiFi adapter on the QEMU guest).

Root-cause confirmation

bwn_dma_rxeof() validates the device-reported frame_len against the wrong constant. dr->dr_rx_bufsize is set to BWN_DMA0_RX_BUFFERSIZE = IEEE80211_MAX_LEN = 2312 (if_bwn.c:2778, if_bwnreg.h:464, ieee80211.h:1297), but the actual RX buffer is an mbuf cluster of MCLBYTES = 2048 allocated by m_getcl() (if_bwn.c:5674) with m_len = MCLBYTES (if_bwn.c:5688). The check at if_bwn.c:5486 (if (len > dr->dr_rx_bufsize)) therefore drops only len > 2312, while any len in (2018, 2312] is kept and immediately produces m_len = len + dr_frameoffset (if_bwn.c:5512, frameoffset=30) greater than the 2048-byte cluster. net80211 processes the mbuf reading up to m_len bytes from a 2048-byte backing cluster -> heap OOB read of up to (2312+30-2048)=294 bytes.

Evidence

• harness.c (run as unprivileged maxx) shows 4/7 frame_len values (2019, 2048, 2100, 2312) pass the kernel check but overrun the 2048-byte cluster by 1..294 bytes; a concrete model with frame_len=2100 reads 82 OOB bytes of an adjacent heap marker.
• Full run: run.log. Build: build.log. Environment (no WiFi HW): env.txt.

Exploit chain / impact

This is an OOB read (CWE-125), not a write primitive, so no uid=0 chain. Realistic impact ceiling: kernel heap info leak up to ~294 bytes per malicious frame (the over-read bytes flow into the received 802.11 frame payload), or a panic if the overrun reaches an unmapped page. AV:A, requires bwn hardware + radio-range attacker.

Fix validation

fix.diff extends the drop check to (u_int)len + dr->dr_frameoffset > MCLBYTES. - git apply --check -p1 => OK. - Compiles in the GENERIC kernel build (nativekernel rc=0; if_bwn.o built clean). - Harness "WITH FIX" pass: 0/7 OOB cases remain. - fix_status: not_testable (HW-gated runtime; apply-check + compile + harness fix-demo + trace all pass).

PoC changes

Evidence pack authored from scratch (seeded dir was empty): harness.c (+ WITH-FIX pass), build.sh, run.sh, fix.diff, VERDICT.md, manifest.json, logs.

Kernel refs (confirmed during verification)

sys/dev/netif/bwn/bwn/if_bwn.c:2778, :5470, :5486, :5512, :5674, :5688; sys/dev/netif/bwn/bwn/if_bwnreg.h:464; sys/netproto/802_11/ieee80211.h:1297.