RX descriptor length not clamped to receive buffer size (OOB heap read / mbuf length overflow)
Summary
ena_rx_mbuf() at ena.c:1457/1466-1467: len=ena_bufs[buf].len (uint16 0-65535) set to mbuf->m_pkthdr.len/m_len without clamping to cluster size. RX buffers allocated with MJUMPAGESIZE=4096 or MCLBYTES=2048 (:915/:921). len>4096 -> mbuf claims more data than buffer -> network stack reads past cluster into adjacent kernel heap -> info leak. Multi-desc path m_append(mbuf,len,...) at :1509 copies len bytes from 4096-byte source. Malicious/buggy ENA device sets length=0xFFFF. Fix: clamp len to rx_info->ena_buf.len.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1222 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 418 B | view raw |
DF-1222 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
RX descriptor length not clamped to receive buffer size (OOB heap read / mbuf length overflow)
Source Location
sys/dev/virtual/amazon/ena/ena.c:1457-1509
Verdict
Source-confirmed: RX descriptor length not clamped to receive buffer size (OOB heap read. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
ena_rx_mbuf() at ena.c:1457/1466-1467: len=ena_bufs[buf].len (uint16 0-65535) set to mbuf->m_pkthdr.len/m_len without clamping to cluster size. RX buffers allocated with MJUMPAGESIZE=4096 or MCLBYTES=2048 (:915/:921). len>4096 -> mbuf claims more data than buffer -> network stack reads past cluster into adjacent kernel heap -> info leak. Multi-desc path m_append(mbuf,len,...) at :1509 copies len bytes from 4096-byte source. Malicious/buggy ENA device sets length=0xFFFF. Fix: clamp len to rx_info
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: ena RX len from NIC not clamped to mbuf buffer size. Added MJUM16BYTES clamp. HW-gated (ENA virtual NIC).
Verified recommended fix
Source-confirmed: ena RX len from NIC not clamped to mbuf buffer size. Added MJUM16BYTES clamp. HW-gated (ENA virtual NIC).
Verdict
Source-confirmed: ena RX len from NIC not clamped to mbuf buffer size. Added MJUM16BYTES clamp. HW-gated (ENA virtual NIC).
No comments yet.