alc_rxeof indexes alc_rxdesc[256] with hardware-controlled rx_cons (12-bit) and nsegs (4-bit) without bounds validation
Summary
alc_rxeof() at if_alc.c:3304-3305: rx_cons=RRD_RD_IDX(rdinfo) is 12-bit (0..4095) but alc_rxdesc[256]. First array access at :3329 uses raw rx_cons before ALC_DESC_INC modulo. OOB read/write on alc_rxdesc[] in kernel heap. Also nsegs=RRD_RD_CNT 4-bit (0..15) unbounded vs ring. Multi-seg m_len at :3372 can go negative if nsegs inconsistent with alc_rxlen. Defense-in-depth: not wire-reachable on correct NIC (descriptor fields are NIC-produced), but exploitable via malicious/buggy NIC (PCIe passthrough, Thunderbolt, errata). Fix: validate rx_cons<ALC_RX_RING_CNT and guard m_len<0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1207 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 715 B | view raw |
DF-1207 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: speculative
Finding
alc_rxeof indexes alc_rxdesc[256] with hardware-controlled rx_cons (12-bit) and nsegs (4-bit) without bounds validation
Source Location
sys/dev/netif/alc/if_alc.c:3304-3372
Verdict
Source-confirmed: alc_rxeof indexes alc_rxdesc[256] with hardware-controlled rx_cons (12. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
alc_rxeof() at if_alc.c:3304-3305: rx_cons=RRD_RD_IDX(rdinfo) is 12-bit (0..4095) but alc_rxdesc[256]. First array access at :3329 uses raw rx_cons before ALC_DESC_INC modulo. OOB read/write on alc_rxdesc[] in kernel heap. Also nsegs=RRD_RD_CNT 4-bit (0..15) unbounded vs ring. Multi-seg m_len at :3372 can go negative if nsegs inconsistent with alc_rxlen. Defense-in-depth: not wire-reachable on correct NIC (descriptor fields are NIC-produced), but exploitable via malicious/buggy NIC (PCIe passthr
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: alc_rxeof indexes alc_rxdesc[256] with HW-controlled rx_cons without bounds check. Added rx_cons bounds guard. HW-gated.
Verified recommended fix
Source-confirmed: alc_rxeof indexes alc_rxdesc[256] with HW-controlled rx_cons without bounds check. Added rx_cons bounds guard. HW-gated.
Verdict
Source-confirmed: alc_rxeof indexes alc_rxdesc[256] with HW-controlled rx_cons without bounds check. Added rx_cons bounds guard. HW-gated.
No comments yet.