ar5112: ar5112GetChannelMaxMinPower returns AH_TRUE on no-match without initializing *minPow -> stale stack leak via 802.11h PowerCapability
Summary
ar5112GetChannelMaxMinPower at ar5112.c:765-793 sets *maxPow=0 at 777 but on fall-through else { return AH_TRUE; } at 791-792 returns success WITHOUT writing *minPow. Sole caller ar5212_reset.c:2360 declares int16_t minPower,maxPower; without init; 2365-2368 if(getChannelMaxMinPower(...)) { chan->ic_maxpower=maxPower/2; chan->ic_minpower=minPower/2; } -> stores stale stack into ic_minpower (int8_t). Transmitted in 802.11h PowerCapability frm[2]=c->ic_minpower at ieee80211_output.c:2070 to any peer in radio range. Sibling ar5111.c:634 returns AH_FALSE -> caller falls back to safe defaults at ar5212_reset.c:2369-2375. Unpriv local user on AR5212+AR5112 ath(4) with HALF/QUARTER/GFSK/ST-only channel flag combo that evades IS_CHAN_A/B/G/108G checks + dot11h enabled. ~7 bits stale kernel stack leak.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1718 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Set *minPow=0 in the fall-through else branch before returning AH_TRUE. | 437 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1718 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: leak:7 Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/netif/ath/ath_hal/ar5212/ar5112.c:791-792.
Mechanism
ar5112GetChannelMaxMinPower sets maxPow but fall-through else returns AH_TRUE without writing minPow; caller stores stale stack into ic_minpower, transmitted in 802.11h PowerCapability frame.
Fix
Set *minPow=0 in the fall-through else branch before returning AH_TRUE.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
ath.ko (if_ath.ko) built standalone with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- n
- e
- t
- i
- f
- /
- a
- t
- h
- /
- a
- t
- h
- _
- h
- a
- l
- /
- a
- r
- 5
- 2
- 1
- 2
- /
- a
- r
- 5
- 1
- 1
- 2
- .
- c
- :
- 7
- 9
- 1
- -
- 7
- 9
- 2
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/netif/ath/ath_hal/ar5212/ar5112.c:791-792. Fix compiled clean.
PoC changes
authored fix.diff: set *minPow=0 in else branch
Verified recommended fix
Set *minPow=0 before returning AH_TRUE in fall-through. Matches finding proposal.
Verdict
REPRODUCED (source-only). Fall-through else returns AH_TRUE without writing *minPow; caller stores stale stack into ic_minpower, leaked via 802.11h PowerCapability frame.
No comments yet.