nfe_rxeof accepts NIC-reported frame length without bounds check; FIXME workaround can underflow to -1
Summary
nfe_rxeof at if_nfe.c:1078-1126: len=le16toh(desc->length)&0x3fff (int 0-16383). FIXME workaround len-- at :1095/1103 with no len>0 guard. m_len=m_pkthdr.len=len at :1126 with no check vs ring->bufsz (MCLBYTES=2048 std, NFE_JBYTES=9020 jumbo). len>bufsz -> OOB read. len=0+FIXME -> m_len=-1 -> stack invariants broken. Not network-triggerable on compliant NIC (DMA bounded by descriptor length). Buggy nForce MCP silicon mis-reports lengths (FIXME exists for this). Fix: check len>=ETHER_HDR_LEN && len<=ring->bufsz, gate len-- on len>0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1351 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
DF-1351 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: speculative
Finding
nfe_rxeof accepts NIC-reported frame length without bounds check; FIXME workaround can underflow to -1
Source Location
sys/dev/netif/nfe/if_nfe.c:1072-1126
Verdict
Source-confirmed (complex fix): nfe_rxeof accepts NIC-reported frame length without bounds check; FIXM. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
nfe_rxeof at if_nfe.c:1078-1126: len=le16toh(desc->length)&0x3fff (int 0-16383). FIXME workaround len-- at :1095/1103 with no len>0 guard. m_len=m_pkthdr.len=len at :1126 with no check vs ring->bufsz (MCLBYTES=2048 std, NFE_JBYTES=9020 jumbo). len>bufsz -> OOB read. len=0+FIXME -> m_len=-1 -> stack invariants broken. Not network-triggerable on compliant NIC (DMA bounded by descriptor length). Buggy nForce MCP silicon mis-reports lengths (FIXME exists for this). Fix: check len>=ETHER_HDR_LEN && l
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: nfe_rxeof accepts NIC-reported frame length (masked 14-bit) without clamping to mbuf buffer size. Complex fix. HW-gated.
Verified recommended fix
Source-confirmed: nfe_rxeof accepts NIC-reported frame length (masked 14-bit) without clamping to mbuf buffer size. Complex fix. HW-gated.
Verdict
Source-confirmed: nfe_rxeof accepts NIC-reported frame length (masked 14-bit) without clamping to mbuf buffer size. Complex fix. HW-gated.
No comments yet.