OOB read: gain_table_entries[32] via unclamped gain_index in ar9300_paprd_setup_gain_table
Summary
In ar9300_paprd_setup_gain_table gain_index search loop (lines 2003-2009) increments gain_index for every gain-table entry below desired_gain. When desired_gain exceeds all 32 entries (8-bit values 0-255) gain_index reaches 32. Passed unclamped to ar9300_tx_force_gain(ah 32) which indexes gain_table_entries[32] one element past end of 32-element paprd_gain_table_entries array. Read lands on paprd_gain_table_index[0] adjacent struct field. No crash (intra-struct) no info leak (value goes to MMIO) but incorrect TX-forced-gain written to radio. Trigger: desired_gain > max(paprd_gain_table_index[0..31]) or negative internal result casts to huge unsigned. Attacker: malicious/faulty ath adapter controls MMIO register reads and EEPROM data. PAPRD calibration uses internal RF loopback not external input so local unprivileged users cannot directly trigger. Impact: RF compliance/performance degradation no kernel memory corruption. CONTRIBUTED vendored code upstream owns fix. [VERIFIED pass2: reproduced - unclamped gain_index 32 aliases entries index 0 via canary bit-exact match into AR_PHY_TX_FORCED_GAIN writes; radio TX gain corruption from faulty ath hardware; clamp fix-validated; contrib upstream owns]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2258 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| rig/dfpaprd_harness.c | trigger-source | verbatim harness with canary KAT controls | 10.3 KB | view raw |
| rig/extract_dfpaprd.sh | extract | byte-identical extraction + sha256 gates | 2.6 KB | view raw |
| run_baseline_gain.log | run-log | double-canary MATCH on stock body | 2.2 KB | view raw |
| fix.diff | suggested-fix | clamp gain_index to 31 | 809 B | view raw |
Fix verification
fixedConfirmed kernel references
Detail
Evidence (decisive lines)
run_baseline_gain.log: canary 0x641 -> writes (1,0,2,3) MATCH; canary 0x129B -> writes (3,3,4,9) MATCH; control -> entries[15] decomposition
PoC changes
Authored rig from scratch (extract-verbatim + KAT canaries); finding had no PoC
Verified recommended fix
clamp gain_index to 31 when the loop exhausts all 32 entries
Verdict
Verbatim-extracted ar9300_paprd_setup_gain_table/ar9300_tx_force_gain proven to read paprd_gain_table_entries[32] (aliasing paprd_gain_table_index[0] per ar9300.h:713-714) when desired_gain exceeds all 32 entries: two distinct canaries planted at index[0] flow bit-exactly into the AR_PHY_TX_FORCED_GAIN register field writes while the control run decomposes entries[15]. No crash, no disclosure to an attacker; impact is a corrupted radio TX-gain configuration from malicious/faulty ath hardware. Contributed code; upstream owns the fix (clamp documented in fix.diff). A/B: Fixed-kernel canary modes produce identical writes (6,3,7,0) decomposing entries[31] (clamped), independent of the index[0] canary: OOB read eliminated.
No comments yet.