[CROSS-FILE: ieee80211_input.c] parse_beacon accepts TIM IE without length verification; scan_sta consumer reads tim_period past IE end (1-2 byte OOB read)
Summary
CROSS-FILE finding (root cause in ieee80211_input.c:586-590, consumer in ieee80211_scan_sta.c:348-351; filed under this run's reserved IDs). ieee80211_parse_beacon stores scan->tim = frm with no payload-length check, unlike rates/ssid/xrates/country/csa/htcap/htinfo which all receive post-loop VERIFY_LENGTH checks. sta_add later casts it to struct ieee80211_tim_ie and reads tim->tim_period (IE offset 3); a trailing TIM IE with len<=1 (legal to the walk's frm[1]+2 bound) makes that read land 1-2 bytes past the mbuf data end. Adjacent attacker (beacon/probe-resp from any AP in radio range): the kernel reads 1-2 bytes past the RX mbuf data region (usually intra-cluster slack); the garbage byte becomes se_dtimperiod and propagates into node DTIM/power-save timing. No corruption, no disclosure - degraded-DoS-grade at worst. Phase V skipped (Low). Fix: mirror the CSA check (VERIFY_LENGTH(tim[1], 3)). [VERIFIED pass2: reproduced via cross-file guard harness - TIM IE stored unvalidated then scan_sta reads tim_period at byte 4; len-ge-2 fix A/B]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3341 · 13 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 821 B | ↓ raw | |
| VERDICT.md | — | 2.1 KB | ↓ raw | |
| allruns.log | — | 4.9 KB | view raw | |
| build.sh | — | 708 B | view raw | |
| df3341.c | — | 1.5 KB | view raw | |
| fix.diff | — | 315 B | view raw | |
| fixbuild.sh | — | 394 B | view raw | |
| fixrun.sh | — | 1.1 KB | view raw | |
| fixruns.log | — | 810 B | view raw | |
| guard.h | — | 1.3 KB | view raw | |
| manifest.json | — | 862 B | view raw | |
| run.sh | — | 2.0 KB | view raw | |
| verdict.json | — | 1.6 KB | view raw |
DF-3341 -- verification pack
Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest) Status: REPRODUCED | impact: none | confidence: certain
What this is
parse_beaon TIM IE stored without length verification (input.c:586-589); scan_sta consumer reads tim->tim_period (byte 4) - a TIM IE with declared len < 3 drives the read past the IE end into stale mbuf bytes (DTIM cache). Verbatim chain harness faults the guard page.
Build
./build.sh
Run
df3341 oob
(success criterion: see VERDICT.md)
Evidence
control (len=5) rc=0; len=1 TIM IE rc=139; FIXED length check clean
Kernel references: sys/netproto/802_11/wlan/ieee80211_input.c:586-589, sys/netproto/802_11/wlan/ieee80211_scan_sta.c:348-351, sys/netproto/802_11/ieee80211.h:952-956
DF-3341 -- VERDICT
REPRODUCED (impact=none, confidence=certain) Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Summary
parse_beaon TIM IE stored without length verification (input.c:586-589); scan_sta consumer reads tim->tim_period (byte 4) - a TIM IE with declared len < 3 drives the read past the IE end into stale mbuf bytes (DTIM cache). Verbatim chain harness faults the guard page.
How it was verified
- Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
- Kernel references: sys/netproto/802_11/wlan/ieee80211_input.c:586-589, sys/netproto/802_11/wlan/ieee80211_scan_sta.c:348-351, sys/netproto/802_11/ieee80211.h:952-956
- Evidence: control (len=5) rc=0; len=1 TIM IE rc=139; FIXED length check clean
- Reachability: local-unpriv where noted in the summary; root-config for tun/lagg/carp/ipfw3/gre items; remote-facing for the packet parsers (wlan harnesses model the RX/TX path verbatim because the guest has no 802.11 hardware; precedent DF-0393/DF-0594/DF-0621/DF-0350).
- Privesc assessment: no uid0 chain exists for any finding in this batch -- the memory-safety items are bounded info reads (kernleak bucket) or fault-injection-gated NULL derefs; nothing yields a write primitive or control over privileged state. The one panic-class live item (DF-3414) is root-only (SIOCIFDESTROY).
Fix
fix_status: fixed -- Harness A/B (fixruns.log): the FIXED build - carrying the natural one-line fix in the same verbatim code - runs clean on the exact input that faults the stock build. Kernel not rebuilt for these Low/hardening items. fix.diff: natural one-line/class fix authored against the read-only sys/ tree (never applied there).
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
fixedHarness A/B (fixruns.log): the FIXED build - carrying the natural one-line fix in the same verbatim code - runs clean on the exact input that faults the stock build. Kernel not rebuilt for these Low/hardening items.
Confirmed kernel references
Detail
Evidence (decisive lines)
control (len=5) rc=0; len=1 TIM IE rc=139; FIXED length check clean
Verified recommended fix
fix.diff
Verdict
parse_beaon TIM IE stored without length verification (input.c:586-589); scan_sta consumer reads tim->tim_period (byte 4) - a TIM IE with declared len < 3 drives the read past the IE end into stale mbuf bytes (DTIM cache). Verbatim chain harness faults the guard page.
No comments yet.