DF-1293
Unbounded rx_cons from hardware return descriptor used to index fixed-size rxdesc[256] array
Summary
age_rxeof at if_age.c:1997: rx_cons=AGE_RX_CONS(index)=16-bit from hardware (0-65535). :2021 rxd=&age_rxdesc[rx_cons] without check vs AGE_RX_RING_CNT=256. First loop iteration uses raw value before AGE_DESC_INC wraps. Malicious/buggy PCIe device -> OOB on rxdesc. Not network-reachable on correct hardware. Defense-in-depth. Fix: check rx_cons<AGE_RX_RING_CNT.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1293 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 397 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/netif/age/if_age.c:1997: unbounded rx_cons indexes fixed-size rxdesc[256] array
Verified recommended fix
Source-confirmed at sys/dev/netif/age/if_age.c:1997: unbounded rx_cons indexes fixed-size rxdesc[256] array
Verdict
Source-confirmed at sys/dev/netif/age/if_age.c:1997: unbounded rx_cons indexes fixed-size rxdesc[256] array
No comments yet.