Missing bounds check on rt->info[] indexing in ath_rate_update allows OOB read past HAL_RATE_TABLE (sibling of DF-1931)
Summary
ath_rate_update L220-248 indexes rt->info[sc_rixmap[rate]] at three sites (series 0/1/2) without checking against rt->rateCount. sc_rixmap initialized 0xff for unmappable rates if_ath.c:6200 memset; rt->info[64] ah.h:681; index 0xff reads ~3056 bytes past end of HAL_RATE_TABLE into adjacent kernel static data. Identical pattern as DF-1931 amrr.c; sample.c:649-656 guards explicitly rix<0||rix>=rt->rateCount but onoe.c omits guard. Three trigger paths: IBSS orphaned node rate not in PHY mode; infrastructure channel/mode switch on live association stale ni_rates; attacker AP advertises alien dot11Rate surviving ieee80211_fix_rate. Impact: OOB read kernel static data rateCode observable in radiotap TX rate 1-byte info channel KASLR bypass; page-fault panic if crosses unmapped page. Fix: rix>=rt->rateCount clamp to 0 mirroring sample.c.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1948 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 501 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 718 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1948 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: ath_rate_update L220-248 indexes rt->info[sc_rixmap[rate]] at three sites (series 0/1/2) without checking against rt->rateCount. sc_rixmap initialized 0xff for unmappable rates if_ath.c:6200 memset; r
Citation: sys/dev/netif/ath/ath_rate/onoe/onoe.c:220-248
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: rt->info[0xff] OOB read via sc_rixmap sentinel (onoe.c:220-248)
Verified recommended fix
Source-confirmed: rt->info[0xff] OOB read via sc_rixmap sentinel (onoe.c:220-248)
Verdict
Source-confirmed: rt->info[0xff] OOB read via sc_rixmap sentinel (onoe.c:220-248)
No comments yet.