DF-2221

ar5312EepromRead unbounded OOB read of radio-config buffer reachable from unprivileged SIOCGATHDIAG/HAL_DIAG_EEREAD

Summary

ar5312EepromRead unconditionally indexes eepromAddr[2*off] and eepromAddr[2*off+1] where eepromAddr=ah->ah_st->radio (BSP-supplied pointer to memory-mapped AR5312 radio-config flash) and off is caller-supplied u_int with NO bounds check NO NULL check on pointer and unconditional return AH_TRUE. Sibling ar5212EepromRead delegates to hardware register read that fails on out-of-range offsets this AR5312 variant has no equivalent guard. Via SIOCGATHDIAG ioctl (ATH_DIAGAPI) unprivileged local user passes id=HAL_DIAG_EEREAD(17) with uint16_t offset flows unchecked through ath_ioctl_diag->ath_hal_getdiagstate->ath_hal_eepromRead->ar5312EepromRead returning 2 leaked bytes per call. No caps_priv_check/suser anywhere on path (net/if.c:2409 ieee80211_ioctl.c:3516 if_ath_ioctl.c:299). Impact: (1) INFO LEAK iterate off 0..65535 dump up to ~128KB adjacent to radio config (board config calibration OEM MAC regdomain or adjacent kernel memory enabling KASLR defeat/secret extraction); (2) LOCAL DoS when 2*off crosses mapped flash window byte load faults (data-access exception/bus error) panics kernel. Required config: AR5312 HAL compiled in (AH_SUPPORT_AR5312) ath interface attached ATH_DIAGAPI enabled. No special caps no authentication purely local software. Also int offset=2*off signed overflow latent for off>=0x40000000 but diag path bounds argsize to 2 bytes.

Discussion (0)

No comments yet.

Severity: High
Status: new
Bucket: Privilege escalation (general use)
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE: CWE-125 Out-of-bounds Read
File: sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c
Lines: 37-45
Area: dev
Discovered: 2026-07-26
Updated: 2026-07-26

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-08-09 14:46:04
Attempts: 1
Runtime: 1s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: n/a (HW/ACPI/device-gated)
Run cmd: ./run.sh # gate check; target device absent

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: no
Patched reproduced: no
Confidence: certain
Tested: 2026-08-09 14:46:04
Runtime: —
Kernel: per-fix-DF-2221
fix.diff: findings/poc/DF-2221/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2221 · 5 files

File	Type	Description	Size
VERDICT.md	verdict	analysis: code bug confirmed, gate confirmed, fix authored	1.6 KB	↓ raw
fix.diff	suggested-fix	git-apply-able defense-in-depth fix (verified --check clean)	1.0 KB	view raw
env.txt	environment	guest gate-proof: usbconfig/pciconf/ifconfig/devinfo/sysctl output	2.0 KB	view raw
build.sh	build-script	no-op (no live-device PoC)	255 B	view raw
run.sh	run-script	gate check (required device is absent)	333 B	view raw

VERDICT.md verdict analysis: code bug confirmed, gate confirmed, fix authored

↓ download raw

DF-2221 — PoC verdict

File: sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c

Verdict: NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth fix.diff is attached.

Mechanism (confirmed in source)

ar5312EepromRead() indexes eepromAddr[2*off] from a caller-supplied u_int off with NO bounds check, NO NULL check on the BSP-supplied radio-config pointer, and unconditionally returns AH_TRUE. The sibling ar5212EepromRead is hardware-guarded; this AR5312 variant is not. Reachable via SIOCGATHDIAG/HAL_DIAG_EEREAD with no privilege check on the path.

Cited lines

sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c:34-46

Why it does not reproduce on this guest

No Atheros AR5312 wifi adapter on the QEMU guest; the AR5312 HAL is not compiled into the running kernel (nm /boot/kernel/kernel: ar5312EepromRead = 0 symbols). usbconfig/ifconfig show no ath interface.

Guest gate-proof (full usbconfig/pciconf/ifconfig/devinfo/sysctl/kldstat output) is in env.txt.

Defense-in-depth fix

Add a NULL check on eepromAddr and bound off against AR5312_EEPROM_MAX (1024 words) added near the function; return AH_FALSE out of range.

The git-apply-able diff is in fix.diff (verified git apply --check clean).

Classification

status: not_reproduced
reproduced: 0
impact: none (not reachable on this guest; latent code bug confirmed in source)
confidence: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
fix_status: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

not_testable: target device absent on this guest. fix.diff applies clean and is source-correct; no live device to exercise.

git apply --check findings/poc/DF-2221/fix.diff -> OK. No runtime test possible (HW/ACPI/device-gated).

↓ fix.diffper-fix-DF-2221

Confirmed kernel references

sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c:34-46

Detail

Exploit chain

none — valid hard blocker (driver/device path dead at runtime on this guest: no target HW/ACPI/device). No unprivileged->root path.

Evidence (decisive lines)

usbconfig list -> No device match; pciconf -l -> no target HW/capability; ifconfig -> vtnet0 lo0; kldstat -> kernel/ehci/xhci only; sysctl/devinfo -> no target OIDs. Source confirmed at cited lines.

PoC changes

Created findings/poc/DF-2221/{VERDICT.md,fix.diff,manifest.json,env.txt,build.sh,run.sh}. No PoC source (HW/ACPI/device-gated).

Verified recommended fix

Defense-in-depth fix.diff closes the cited path (see findings/poc/DF-2221/fix.diff; git apply --check OK).

Verdict

NOT REPRODUCED (HW/ACPI/device-gated on this guest). The bug is REAL in source (traced line-by-line): ath_hal ar5312EepromRead unbounded OOB read (no Atheros wifi; HAL not compiled in). Gate confirmed via usbconfig list (no devices), pciconf -l (no target HW/capability), ifconfig (vtnet0 lo0 only), kldstat (no target module), sysctl/devinfo (no target ACPI/device OIDs). The benign QEMU environment cannot produce the malicious device/ACPI/descriptor the bug requires.