⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2538

Unbounded loop in inquiry_result causes kernel panic from malformed HCI Inquiry Result event

Summary

inquiry_result loops ep->num_responses times attacker-controlled u_int8_t reading 14 bytes per iteration via m_copydata with zero validation mbuf contains num_responses*14 bytes. Malformed Inquiry Result event whose num_responses exceeds payload drives m_copydata past mbuf chain tripping KASSERT panic or NULL-deref. Reliable kernel panic from any Bluetooth controller emitting malformed event. USB BT dongle BadUSB no authentication. No pairing needed.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2538 · 5 files
FileTypeDescriptionSize
VERDICT.md verdict analysis: code bug confirmed, gate confirmed, fix authored 1.6 KB ↓ raw
fix.diff suggested-fix git-apply-able defense-in-depth fix (verified --check clean) 696 B view raw
env.txt environment guest gate-proof: usbconfig/pciconf/ifconfig/devinfo/sysctl output 2.0 KB view raw
build.sh build-script no-op (no live-device PoC) 255 B view raw
run.sh run-script gate check (required device is absent) 333 B view raw
VERDICT.md verdict analysis: code bug confirmed, gate confirmed, fix authored
↓ download raw

DF-2538 — PoC verdict

File: sys/netgraph7/bluetooth/hci/ng_hci_evnt.c

Verdict: NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth fix.diff is attached.

Mechanism (confirmed in source)

inquiry_result() loops ep->num_responses times (attacker-controlled u_int8_t from the HCI Inquiry Result event), reading 14 bytes per iteration via m_copydata/m_adj with no validation that the mbuf chain contains that much data. A malformed event whose num_responses exceeds the payload reads past the chain (KASSERT panic / NULL deref).

Cited lines

Why it does not reproduce on this guest

No Bluetooth controller (and netgraph7 bluetooth is not built into the running kernel: nm /boot/kernel/kernel inquiry_result=0). The bug needs a real or USB BT dongle emitting a malformed Inquiry Result event.

Guest gate-proof (full usbconfig/pciconf/ifconfig/devinfo/sysctl/kldstat output) is in env.txt.

Defense-in-depth fix

Check event->m_len >= (sizeof(bdaddr)+3+CLASS_SIZE+sizeof(clock_offset)) each iteration and break if the remaining payload is too short.

The git-apply-able diff is in fix.diff (verified git apply --check clean).

Classification

  • status: not_reproduced
  • reproduced: 0
  • impact: none (not reachable on this guest; latent code bug confirmed in source)
  • confidence: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
  • fix_status: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

not_testable: target device absent on this guest. fix.diff applies clean and is source-correct; no live device to exercise.

git apply --check findings/poc/DF-2538/fix.diff -> OK. No runtime test possible (HW/ACPI/device-gated).
↓ fix.diffper-fix-DF-2538

Confirmed kernel references

Detail

Exploit chain

none — valid hard blocker (driver/device path dead at runtime on this guest: no target HW/ACPI/device). No unprivileged->root path.

Evidence (decisive lines)

usbconfig list -> No device match; pciconf -l -> no target HW/capability; ifconfig -> vtnet0 lo0; kldstat -> kernel/ehci/xhci only; sysctl/devinfo -> no target OIDs. Source confirmed at cited lines.

PoC changes

Created findings/poc/DF-2538/{VERDICT.md,fix.diff,manifest.json,env.txt,build.sh,run.sh}. No PoC source (HW/ACPI/device-gated).

Verified recommended fix

Defense-in-depth fix.diff closes the cited path (see findings/poc/DF-2538/fix.diff; git apply --check OK).

Verdict

NOT REPRODUCED (HW/ACPI/device-gated on this guest). The bug is REAL in source (traced line-by-line): ng_hci_evnt unbounded loop in inquiry_result (no bluetooth; netgraph7). Gate confirmed via usbconfig list (no devices), pciconf -l (no target HW/capability), ifconfig (vtnet0 lo0 only), kldstat (no target module), sysctl/devinfo (no target ACPI/device OIDs). The benign QEMU environment cannot produce the malicious device/ACPI/descriptor the bug requires.