Summary

ath_ioctl_spectral (if_ath_spectral.c:218): outdata=kmalloc(ad_out_size,M_TEMP,M_INTWAIT) user-controlled size. GET_PARAMS at 227 reassigns outsize=sizeof(HAL_SPECTRAL_PARAM)(~36) AFTER allocation no effect on already-allocated buffer; line 230 memcpy(pe,&peout,sizeof(*pe)) unconditional. User ad_out_size=1 -> kmalloc(1) then memcpy 36 bytes -> 35-byte heap overflow. No ATH_DIAG_DYN -> outdata stays NULL -> memcpy(NULL,...) -> kernel panic. No validation outdata!=NULL or outsize>=sizeof. NO priv check on entire path (if.c:2409 default ieee80211_ioctl.c:3516 default if_ath_ioctl.c:304). Any local user on host with spectral-capable ath(4). Heap overflow bytes are peout struct (memset 0 then partly from PHY regs via ath_hal_spectral_get_config) -> partial slab-grooming primitive. AV:L/PR:L/AC/L, C:H/I:H/A:H.

PoC verification

Evidence pack

findings/poc/DF-2079 · 6 files

File	Type	Description	Size
VERDICT.md	verdict	source-level analysis with path:line citations	1.9 KB	↓ raw
reachability.txt	environment	guest PCI/device survey proving no required HW	1.6 KB	view raw
fix.diff	suggested-fix	git-apply-able fix (validated: applies clean)	540 B	view raw
build.sh	build-log	documents HW requirement	550 B	view raw
run.sh	run-log	documents HW requirement	272 B	view raw
env.txt	environment	guest uname and environment	491 B	view raw

VERDICT.md verdict source-level analysis with path:line citations

↓ download raw

DF-2079: Heap buffer overflow in ath_ioctl_spectral GET_PARAMS

Verdict: NOT REPRODUCED (HW-gated) — source-confirmed real bug

Reachability

NOT reachable on this QEMU guest. ath_ioctl_spectral() is in if_ath_spectral.c, part of the ath(4) driver compiled into GENERIC (device ath). However, no Atheros WiFi PCI hardware is present: - ifconfig ath0 create → "SIOCIFCREATE2: Invalid argument" (no ath(4) attach possible) - PCI survey: no Atheros wireless chip (only virtio-net)

The spectral ioctl is reached via SIOCATHDIAG on an athN interface — which requires a real Atheros NIC.

Mechanism (source-confirmed)

ath_ioctl_spectral() at sys/dev/netif/ath/ath/if_ath_spectral.c:180-293: 1. Line 187: outsize = ad->ad_out_size — user-controlled output buffer size 2. Line 210-218: if ATH_DIAG_DYN flag set, outdata = kmalloc(outsize, M_TEMP, M_INTWAIT) — allocates user-controlled size 3. Line 225-230: SPECTRAL_CONTROL_GET_PARAMS case: - Line 227: outsize = sizeof(HAL_SPECTRAL_PARAM) — reassigned after allocation - Line 230: memcpy(pe, &peout, sizeof(*pe)) — writes sizeof(HAL_SPECTRAL_PARAM) bytes (~36 bytes) into the outdata buffer

If user sets ad_out_size < sizeof(HAL_SPECTRAL_PARAM) (e.g. ad_out_size=1), the kmalloc(1) allocates a tiny buffer, but memcpy writes 36 bytes → heap overflow.

Additionally, line 201: indata = kmalloc(insize, ...) where insize = ad->ad_in_size is also user-controlled with no upper bound check — potential large allocation DoS.

Primitive

Class: heap buffer overflow (OOB write)
Overflow size: up to sizeof(HAL_SPECTRAL_PARAM) - 1 bytes past allocation
Attacker controls allocation size via ad_out_size → can target specific slab bucket

Fix

fix.diff: Add size validation before the memcpy in SPECTRAL_CONTROL_GET_PARAMS: if outdata != NULL && outsize < sizeof(HAL_SPECTRAL_PARAM), return EINVAL.

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

git apply --check clean

git apply --check clean

↓ fix.diffn/a

Confirmed kernel references

—

Detail

Exploit chain

none (HW-gated)

Evidence (decisive lines)

HW-GATED (no Atheros WiFi). Source-confirmed: ath_ioctl_spectral kmalloc(outsize=user-controlled) then memcpy sizeof(HAL_SPECTRAL_PARAM). ifconfig ath0 create fails.

Verified recommended fix

HW-GATED (no Atheros WiFi). Source-confirmed: ath_ioctl_spectral kmalloc(outsize=user-controlled) then memcpy sizeof(HAL_SPECTRAL_PARAM). ifconfig ath0 create fails.

Verdict