ieee80211_parse_ath heap OOB read: Atheros vendor IE length never validated on the hostap assoc path (SUPERG kernels)
Summary
On the assoc-req IE walk the ath IE is matched by isatherosoui(frm) which only guarantees frm[1] > 3; unlike htcap its length is never verified. ieee80211_parse_ath() reads ath_capability (offset 8) and ath_defkeyix (9-10) - struct ieee80211_ath_ie needs frm[1] == 9. With frm[1] = 4..8 and the ath IE as the LAST element, 1-3 bytes are read past the end of the kmalloc'd ni_ies.data blob into adjacent heap; values land in ni_ath_flags/ni_ath_defkeyix (no userland disclosure path in DF). Reachable from an unauthenticated (post-open-auth) assoc request on kernels built with IEEE80211_SUPPORT_SUPERG - NOT in stock X86_64_GENERIC but FreeBSD builds its wlan module with SUPERG on by default, so the bug ships there. Not run (stock kernel lacks the call site; 3-byte OOB read, no observable output). Fix: validate IE length before parsing (mirror the htcap check; or inside parse_ath to cover the adhoc.c site too). [VERIFIED pass2: reproduced via guard harness - ath IE len-gate admits 6-byte saved IE while parse reads bytes 6-8; length-check fix A/B]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3324 · 13 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 971 B | ↓ raw | |
| VERDICT.md | — | 2.3 KB | ↓ raw | |
| allruns.log | — | 4.9 KB | view raw | |
| build.sh | — | 708 B | view raw | |
| df3324.c | — | 3.0 KB | view raw | |
| fix.diff | — | 497 B | view raw | |
| fixbuild.sh | — | 394 B | view raw | |
| fixrun.sh | — | 1.1 KB | view raw | |
| fixruns.log | — | 810 B | view raw | |
| guard.h | — | 1.3 KB | view raw | |
| manifest.json | — | 962 B | view raw | |
| run.sh | — | 2.0 KB | view raw | |
| verdict.json | — | 1.7 KB | view raw |
DF-3324 -- verification pack
Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest) Status: REPRODUCED | impact: none | confidence: certain
What this is
hostap assoc path accepts a minimal (len=4) Atheros vendor IE via isatherosoui() and ieee80211_parse_ath() then reads ath_capability+ath_defkeyix (bytes 6..8) past the 6-byte saved-IE allocation (SUPERG kernels; wlan module absent on this radio-less guest so verbatim harness: 3-byte heap over-read faults the guard page).
Build
./build.sh
Run
df3324 oob
(success criterion: see VERDICT.md)
Evidence
control (16-byte alloc) rc=0; 6-byte saveie allocation + parse_ath faults rc=139; FIXED length check clean
Kernel references: sys/netproto/802_11/wlan/ieee80211_hostap.c:2007, sys/netproto/802_11/wlan/ieee80211_hostap.c:2155-2160, sys/netproto/802_11/wlan/ieee80211_superg.c:199-207, sys/netproto/802_11/ieee80211_input.h:111-115
DF-3324 -- VERDICT
REPRODUCED (impact=none, confidence=certain) Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Summary
hostap assoc path accepts a minimal (len=4) Atheros vendor IE via isatherosoui() and ieee80211_parse_ath() then reads ath_capability+ath_defkeyix (bytes 6..8) past the 6-byte saved-IE allocation (SUPERG kernels; wlan module absent on this radio-less guest so verbatim harness: 3-byte heap over-read faults the guard page).
How it was verified
- Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
- Kernel references: sys/netproto/802_11/wlan/ieee80211_hostap.c:2007, sys/netproto/802_11/wlan/ieee80211_hostap.c:2155-2160, sys/netproto/802_11/wlan/ieee80211_superg.c:199-207, sys/netproto/802_11/ieee80211_input.h:111-115
- Evidence: control (16-byte alloc) rc=0; 6-byte saveie allocation + parse_ath faults rc=139; FIXED length check clean
- Reachability: local-unpriv where noted in the summary; root-config for tun/lagg/carp/ipfw3/gre items; remote-facing for the packet parsers (wlan harnesses model the RX/TX path verbatim because the guest has no 802.11 hardware; precedent DF-0393/DF-0594/DF-0621/DF-0350).
- Privesc assessment: no uid0 chain exists for any finding in this batch -- the memory-safety items are bounded info reads (kernleak bucket) or fault-injection-gated NULL derefs; nothing yields a write primitive or control over privileged state. The one panic-class live item (DF-3414) is root-only (SIOCIFDESTROY).
Fix
fix_status: fixed -- Harness A/B (fixruns.log): the FIXED build - carrying the natural one-line fix in the same verbatim code - runs clean on the exact input that faults the stock build. Kernel not rebuilt for these Low/hardening items. fix.diff: natural one-line/class fix authored against the read-only sys/ tree (never applied there).
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
fixedHarness A/B (fixruns.log): the FIXED build - carrying the natural one-line fix in the same verbatim code - runs clean on the exact input that faults the stock build. Kernel not rebuilt for these Low/hardening items.
Confirmed kernel references
Detail
Evidence (decisive lines)
control (16-byte alloc) rc=0; 6-byte saveie allocation + parse_ath faults rc=139; FIXED length check clean
Verified recommended fix
fix.diff
Verdict
hostap assoc path accepts a minimal (len=4) Atheros vendor IE via isatherosoui() and ieee80211_parse_ath() then reads ath_capability+ath_defkeyix (bytes 6..8) past the 6-byte saved-IE allocation (SUPERG kernels; wlan module absent on this radio-less guest so verbatim harness: 3-byte heap over-read faults the guard page).
No comments yet.