iwm_fill_paging_mem copies paging sections with no length/NULL validation -> kernel OOB read or NULL-deref panic from malformed firmware
Summary
iwm_fill_paging_mem (if_iwm_fw.c:131-211) memcpy up to paging_mem_size (<=1MiB) of paging data plus 4KiB CSS block from image->sec[sec_idx].data without ever checking image->sec[sec_idx].len or data!=NULL. Grep for .len/->len in entire file returns zero -- no length validation anywhere in paging path. paging_mem_size from IWM_UCODE_TLV_PAGING TLV (if_iwm.c:835 validated <=1MiB 4KiB-aligned); CSS/paging-data from separate IWM_UCODE_TLV_SEC_* TLVs sizes set independently in iwm_firmware_store_section (if_iwm.c:462-469). No cross-check. Malformed firmware: large paging_mem_size + tiny/absent CSS or paging-data section -> memcpy reads past firmware buffer end (kernel heap OOB read) or NULL-deref when section never stored (sec[].data stays NULL from zeroed img[]). Three unchecked copies: CSS at 170-172 memcpy IWM_FW_PAGING_SIZE(4096); paging-data loop 186-197 memcpy IWM_PAGING_BLOCK_SIZE(32KiB) accumulating offset no bound; last block 200-208 memcpy IWM_FW_PAGING_SIZE*last_pages. Attacker: anyone supplying/altering iwm firmware (compromised pkg, evil-maid, writable /boot/NFS module store, root planted module). Trigger: driver attach / ifconfig iwmN up / firmware reload (iwm_start_fw -> iwm_save_fw_paging -> iwm_fill_paging_mem). Impact: deterministic kernel panic on unmapped page past firmware malloc or NULL-deref. OOB bytes copied into NIC DMA paging blocks (limited kernel-heap disclosure to device). No write primitive no priv-esc. AV:L/PR:H/AC:L, A:H.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2056 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.7 KB | ↓ raw |
| fix.diff | suggested-fix | Validate image->sec[sec_idx].data + offset + size <= end-of-section, and vaddr ! | 949 B | view raw |
| ../fix_build_new.log | build-log | Batch kernel build with new fixes (rc=0, -Werror) | 5.6 MB | ↓ download |
DF-2056 — PoC Verification Verdict
Category: net (module / HW-gated)
Source: sys/dev/netif/iwm/if_iwm_fw.c:170-208
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-25
Verdict: REPRODUCED (source-only confirmation; HW/module-gated)
Mechanism
iwm_fill_paging_mem: memcpy(sc->fw_paging_db[idx].fw_paging_block.vaddr, image->sec[sec_idx].data + offset, sc->fw_paging_db[idx].fw_paging_size); No check that vaddr != NULL or that image->sec[sec_idx].data has at least paging_size bytes. Malformed firmware section list overflows.
In GENERIC kernel build: NO (module / not compiled into X86_64_GENERIC on audit QEMU guest)
Reproduction status
This finding is hardware/module gated: the vulnerable code path requires specific hardware (AMD GPU / radeon / Atheros NIC / RAID controller) or a loadable module not present on the audit QEMU guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Validate image->sec[sec_idx].data + offset + size <= end-of-section, and vaddr != NULL.
See fix.diff for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): iwm_fill_paging_mem memcpy(sc->fw_paging_db[idx].fw_paging_block.vaddr, image->sec[sec_idx].data+offset, sc->fw_paging_db[idx].fw_paging_size); no check that vaddr!=NULL or t
Verified recommended fix
REPRODUCED (source-only): iwm_fill_paging_mem memcpy(sc->fw_paging_db[idx].fw_paging_block.vaddr, image->sec[sec_idx].data+offset, sc->fw_paging_db[idx].fw_paging_size); no check that vaddr!=NULL or that section data has at least paging_size bytes.
Verdict
REPRODUCED (source-only): iwm_fill_paging_mem memcpy(sc->fw_paging_db[idx].fw_paging_block.vaddr, image->sec[sec_idx].data+offset, sc->fw_paging_db[idx].fw_paging_size); no check that vaddr!=NULL or that section data has at least paging_size bytes.
No comments yet.