Unbounded SROM/EEPROM parsing in tulip_srom_decode causes OOB reads from tulip_rombuf[128] at device attach
Summary
tulip_srom_decode() at if_de.c:2072-2421 parses on-card EEPROM (tulip_rombuf[128]) using offsets/block counts/lengths directly from EEPROM with no bounds validation. sh_adapter_count (rombuf[19],0-255) unbounded at :2084 strides saip past rombuf. leaf_offset at :2107 ranges 0-65535, dp set at :2109 with no check < 128 -> immediate OOB. Block loops read lengths/counts at :2121/:2183/:2190 then advance dp += mi->mi_gpr_length (up to 255) at :2231/:2333 etc -> dp walks ~195KB into kernel memory. mi_gpr_offset/mi_reset_offset stored OOB, later consumed by tulip_media_set() at :299/:313/:318. CRC gate ineffective: attacker computes valid CRC, or CRC failure still sets ISVSROM on 21142+ (:2498). RX path clean: TULIP_RX_BUFLEN=2032<=MCLBYTES. Fix: bound sh_adapter_count, validate leaf_offset<128, add dpend guard to every dp advance.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1205 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
DF-1205 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
Unbounded SROM/EEPROM parsing in tulip_srom_decode causes OOB reads from tulip_rombuf[128] at device attach
Source Location
sys/dev/netif/de/if_de.c:2072-2336
Verdict
Source-confirmed (complex fix): Unbounded SROM/EEPROM parsing in tulip_srom_decode causes OOB reads fr. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
tulip_srom_decode() at if_de.c:2072-2421 parses on-card EEPROM (tulip_rombuf[128]) using offsets/block counts/lengths directly from EEPROM with no bounds validation. sh_adapter_count (rombuf[19],0-255) unbounded at :2084 strides saip past rombuf. leaf_offset at :2107 ranges 0-65535, dp set at :2109 with no check < 128 -> immediate OOB. Block loops read lengths/counts at :2121/:2183/:2190 then advance dp += mi->mi_gpr_length (up to 255) at :2231/:2333 etc -> dp walks ~195KB into kernel memory. mi
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: Unbounded SROM/EEPROM parsing in tulip_srom_decode causes OOB reads from tulip_rombuf[128]. HW-gated (tulip NIC). Complex fix.
Verified recommended fix
Source-confirmed: Unbounded SROM/EEPROM parsing in tulip_srom_decode causes OOB reads from tulip_rombuf[128]. HW-gated (tulip NIC). Complex fix.
Verdict
Source-confirmed: Unbounded SROM/EEPROM parsing in tulip_srom_decode causes OOB reads from tulip_rombuf[128]. HW-gated (tulip NIC). Complex fix.
No comments yet.