SROM/EEPROM parsing unbounded OOB heap reads via unchecked offsets and lengths
Summary
dc_parse_21143_srom at if_dc.c:1780-1823: loff=sc->dc_srom[27] unchecked used as index into SROM (128-8192B). Leaf header deref at loff OOB. Block walk: ptr+=(hdr->dc_len&0x7F)+1 per block, dc_mcnt up to 255, no bounds -> ptr advances up to 32KB past buffer. dc_decode_leaf_mii: p+=2*dc_gpr_len (up to 510B) -> OOB-derived m->dc_reset_ptr/dc_gp_ptr. dc_apply_fixup iterates OOB pointers in loops writing to DC_WATCHDOG. Sibling of DF-1205 (if_de.c SROM OOB). Malicious PCI device EEPROM. Fix: store dc_srom_len, validate every offset against it.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1248 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1001 B | ↓ raw |
DF-1248 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
SROM/EEPROM parsing unbounded OOB heap reads via unchecked offsets and lengths
Source Location
sys/dev/netif/dc/if_dc.c:1744-1823
Verdict
Source-confirmed (complex fix): SROM/EEPROM parsing unbounded OOB heap reads via unchecked offsets and. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
dc_parse_21143_srom at if_dc.c:1780-1823: loff=sc->dc_srom[27] unchecked used as index into SROM (128-8192B). Leaf header deref at loff OOB. Block walk: ptr+=(hdr->dc_len&0x7F)+1 per block, dc_mcnt up to 255, no bounds -> ptr advances up to 32KB past buffer. dc_decode_leaf_mii: p+=2*dc_gpr_len (up to 510B) -> OOB-derived m->dc_reset_ptr/dc_gp_ptr. dc_apply_fixup iterates OOB pointers in loops writing to DC_WATCHDOG. Sibling of DF-1205 (if_de.c SROM OOB). Malicious PCI device EEPROM. Fix: store d
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: dc_decode_srom uses unchecked EEPROM-derived offsets/lengths for SROM parsing, enabling OOB heap reads from dc_srom. Complex fix. HW-gated.
Verified recommended fix
Source-confirmed: dc_decode_srom uses unchecked EEPROM-derived offsets/lengths for SROM parsing, enabling OOB heap reads from dc_srom. Complex fix. HW-gated.
Verdict
Source-confirmed: dc_decode_srom uses unchecked EEPROM-derived offsets/lengths for SROM parsing, enabling OOB heap reads from dc_srom. Complex fix. HW-gated.
No comments yet.