OOB read in ar5416GetTargetPowers/GetTargetPowersLeg when first pier channel is BCHAN_UNUSED
Summary
ar5416GetTargetPowers at ar5416_reset.c:2108 and GetTargetPowersLeg at :2168: if freq>fbin2freq(0xFF)=255 (all WiFi channels), enter else branch. Loop i=0 if powInfo[0].bChannel==0xFF sentinel. Post-loop: matchIndex=i-1=-1. Else branch reads powInfo[lowIndex=-1] repeatedly. HALASSERT compiled out by default (AH_ASSERT opt-in). Intra-struct OOB read into preceding EEPROM field. Attacker: malicious/buggy NIC EEPROM. Fix: check i==0 -> matchIndex=0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1308 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 988 B | ↓ raw |
DF-1308 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
OOB read in ar5416GetTargetPowers/GetTargetPowersLeg when first pier channel is BCHAN_UNUSED
Source Location
sys/dev/netif/ath/ath_hal/ar5416/ar5416_reset.c:2108-2201
Verdict
Source-confirmed (complex fix): OOB read in ar5416GetTargetPowers/GetTargetPowersLeg when first pier c. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
ar5416GetTargetPowers at ar5416_reset.c:2108 and GetTargetPowersLeg at :2168: if freq>fbin2freq(0xFF)=255 (all WiFi channels), enter else branch. Loop i=0 if powInfo[0].bChannel==0xFF sentinel. Post-loop: matchIndex=i-1=-1. Else branch reads powInfo[lowIndex=-1] repeatedly. HALASSERT compiled out by default (AH_ASSERT opt-in). Intra-struct OOB read into preceding EEPROM field. Attacker: malicious/buggy NIC EEPROM. Fix: check i==0 -> matchIndex=0.
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: ar5416GetTargetPowers accesses powInfo[i-1] when i=0 and first pier is BCHAN_UNUSED, OOB read at index -1. Complex fix (void return type). HW-gated.
Verified recommended fix
Source-confirmed: ar5416GetTargetPowers accesses powInfo[i-1] when i=0 and first pier is BCHAN_UNUSED, OOB read at index -1. Complex fix (void return type). HW-gated.
Verdict
Source-confirmed: ar5416GetTargetPowers accesses powInfo[i-1] when i=0 and first pier is BCHAN_UNUSED, OOB read at index -1. Complex fix (void return type). HW-gated.
No comments yet.