ar5210_misc: NULL pointer write in HAL_DIAG_EEREAD via ar5210GetDiagState (unprivileged local DoS)
Summary
ar5210GetDiagState HAL_DIAG_EEREAD at 642 passes *result unchecked into ath_hal_eepromRead->ar5210EepromRead. ath_ioctl_diag (if_ath_ioctl.c:170-235) initializes outdata=NULL only allocates inside if(ad_id&ATH_DIAG_DYN) at 193. Without DYN, outdata stays NULL. ar5210EepromRead at 77 *data=OS_REG_READ(AR_EP_RDATA)&0xffff writes 16 bits to address 0 -> kernel page fault panic. Offset 0 (AR_EEPROM_MAC) always readable so guaranteed trigger. SIOCGATHDIAG has NO priv check (ieee80211_ioctl default case 3516-3522 no caps_priv_check; contrast SIOCS80211 at 3472 checks SYSCAP_NONET_WIFI). Any local user with socket on ath(4) interface. Same bug class in ah.c:904 fallback compiled unconditionally reachable on ALL ath HALs. Fix: if(argsize!=2 || result==NULL || *result==NULL) return AH_FALSE.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1819 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source verification narrative | 1.2 KB | ↓ raw |
| fix.diff | suggested-fix | Fix: Validate result==NULL || *result==NULL before passing to eeprom read. | 514 B | view raw |
| build.sh | build-script | Build/validation instructions | 366 B | view raw |
| run.sh | run-script | Run instructions (HW-gated, source-only) | 184 B | view raw |
| env.txt | environment | Guest environment | 404 B | view raw |
DF-1819 - Source Verification
Verdict: REPRODUCED (source-only confirmation)
Finding: sys/dev/netif/ath/ath_hal/ar5210/ar5210_misc.c:642
Mechanism: HAL_DIAG_EEREAD passes result unchecked into ar5210EepromRead which writes data=OS_REG_READ(...)&0xffff to address 0 if outdata is NULL → kernel page fault panic. No priv check on SIOCGATHDIAG.
Hardware dependency: Requires ath(4) ar5210 hardware + AH_PRIVATE_DIAG.
Fix: Validate result==NULL || *result==NULL before passing to eeprom read.
Verification method
Source-only confirmation. The cited code path was traced line-by-line in the audited sys/ tree. The bug exists exactly as described. This is a HW-gated driver finding — the vulnerable code path requires specific hardware (GPU, controller, PHY, TPM, etc.) not present in the QEMU audit guest. Runtime reproduction on this guest is not possible without the hardware.
Fix validation
fix.diff authored and applied to guest source. All 40 fixes in this batch
compile cleanly in a single combined kernel build: make -j6 nativekernel
KERNCONF=X86_64_GENERIC → rc=0, zero -Werror violations.
Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
Fix verification
not_testablenot_testable: HW-gated. fix.diff applies + compiles in batch build (rc=0 -Werror). Source trace confirms fix closes the path.
Batch build: 40 fix.diffs applied, make nativekernel → rc=0 -Werror. Bug at sys/dev/netif/ath/ath_hal/ar5210/ar5210_misc.c:642 source-confirmed.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- n
- e
- t
- i
- f
- /
- a
- t
- h
- /
- a
- t
- h
- _
- h
- a
- l
- /
- a
- r
- 5
- 2
- 1
- 0
- /
- a
- r
- 5
- 2
- 1
- 0
- _
- m
- i
- s
- c
- .
- c
- :
- 6
- 4
- 2
Detail
Exploit chain
none
Evidence (decisive lines)
Source trace sys/dev/netif/ath/ath_hal/ar5210/ar5210_misc.c:642. HW-gated (no HW in QEMU). Fix compiles in batch build rc=0.
PoC changes
Evidence pack: VERDICT.md, fix.diff, manifest.json. Fix: HAL_DIAG_EEREAD NULL page fault via unchecked *result. Validate result!=NULL.
Verified recommended fix
See fix.diff. HAL_DIAG_EEREAD NULL page fault via unchecked *result. Validate result!=NULL.
Verdict
REPRODUCED (source-only). sys/dev/netif/ath/ath_hal/ar5210/ar5210_misc.c:642: HAL_DIAG_EEREAD NULL page fault via unchecked *result. Validate result!=NULL.
No comments yet.