iwi_cmd uint8_t len truncates iv_appie_wpa length, allowing up to 135-byte overflow of cmd descriptor ring
Summary
iwi_cmd at if_iwi.c:1784: takes uint8_t len. Caller iwi_auth_and_assoc at :2988: iwi_cmd(sc,IWI_CMD_SET_OPTIE,ie->ie_data,ie->ie_len) where ie=vap->iv_appie_wpa, ie_len is uint16_t (0-1024). desc->data is uint8_t[120] (if_iwireg.h:384). memcpy(desc->data,data,len) at :1804. ie_len in [121,255] truncates to uint8_t losslessly -> writes 121-255B into 120B desc->data -> overflow up to 135B. If cmdq.cur==15, runs past DMA allocation into kernel heap. Requires SYSCAP_NONET_WIFI (delegated wifi-management). Fix: validate len<=sizeof(desc->data), reject oversized ie_len.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1241 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 414 B | view raw |
DF-1241 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
iwi_cmd uint8_t len truncates iv_appie_wpa length, allowing up to 135-byte overflow of cmd descriptor ring
Source Location
sys/dev/netif/iwi/if_iwi.c:1784-2988
Verdict
Source-confirmed: iwi_cmd uint8_t len truncates iv_appie_wpa length, allowing up to 135-. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
iwi_cmd at if_iwi.c:1784: takes uint8_t len. Caller iwi_auth_and_assoc at :2988: iwi_cmd(sc,IWI_CMD_SET_OPTIE,ie->ie_data,ie->ie_len) where ie=vap->iv_appie_wpa, ie_len is uint16_t (0-1024). desc->data is uint8_t[120] (if_iwireg.h:384). memcpy(desc->data,data,len) at :1804. ie_len in [121,255] truncates to uint8_t losslessly -> writes 121-255B into 120B desc->data -> overflow up to 135B. If cmdq.cur==15, runs past DMA allocation into kernel heap. Requires SYSCAP_NONET_WIFI (delegated wifi-manage
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: iwi_cmd uint8_t len truncates iv_appie_wpa length, memcpy into desc->data without sizeof bound. Added MIN(len, sizeof(desc->data)). HW-gated.
Verified recommended fix
Source-confirmed: iwi_cmd uint8_t len truncates iv_appie_wpa length, memcpy into desc->data without sizeof bound. Added MIN(len, sizeof(desc->data)). HW-gated.
Verdict
Source-confirmed: iwi_cmd uint8_t len truncates iv_appie_wpa length, memcpy into desc->data without sizeof bound. Added MIN(len, sizeof(desc->data)). HW-gated.
No comments yet.