Buffer over-read + u16 length underflow in e1000_mng_host_if_write_generic on misaligned offset with short length
Summary
e1000_mng_host_if_write_generic L237 validates only length!=0&&offset+length<=E1000_HI_MAX_MNG_DATA_LENGTH(0x6F8) not relationship between length and offset&0x3. L241 prev_bytes=offset&0x3. L244-253 when prev_bytes!=0 inner for(j=prev_bytes;j<sizeof(u32);j++) always iterates 4-prev_bytes times reading via *bufptr++ regardless of length. L251 length-=j-prev_bytes (=length-(4-prev_bytes)) underflows u16 when length<(4-prev_bytes). Underflowed length propagates: L255 remaining=length&0x3 L256 length-=remaining L259 length>>=2 main loop L264 for(i=0;i<length) ~0x3FFF iterations each consuming 4 bytes bufptr. Trigger offset=1 length=1 passes bounds (1+1=2<=0x6F8) reads 3+16383*4+2=65537 bytes from 1-byte source. LATENT: only in-tree caller e1000_mng_write_dhcp_info_generic L297-333 passes offset=8 aligned prev_bytes==0 buggy branch never reached. Exported via e1000_api.c:942-946. Fix: reject offset&0x3&&length<(sizeof(u32)-(offset&0x3)).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1888 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 394 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 715 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1888 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: e1000_mng_host_if_write_generic L237 validates only length!=0&&offset+length<=E1000_HI_MAX_MNG_DATA_LENGTH(0x6F8) not relationship between length and offset&0x3. L241 prev_bytes=offset&0x3. L244-253 w
Citation: sys/dev/netif/ig_hal/e1000_manage.c:237-264
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: buffer over-read + u16 length underflow in host-if write (e1000_manage.c:237-264)
Verified recommended fix
Source-confirmed: buffer over-read + u16 length underflow in host-if write (e1000_manage.c:237-264)
Verdict
Source-confirmed: buffer over-read + u16 length underflow in host-if write (e1000_manage.c:237-264)
No comments yet.