DF-3577 — 4-byte heap OOB read in iwn_read_firmware_tlv() (IWN_FW_TLV_PHY_CALIB)

What this is

Evidence pack for an out-of-bounds read in the iwn firmware TLV parser, sys/dev/netif/iwn/if_iwn.c:8315-8320:

case IWN_FW_TLV_PHY_CALIB:
        tmp = le32toh(*ptr);          /* if_iwn.c:8316 — no len check! */
        if (tmp < 253) {
                sc->reset_noise_gain = tmp;
                sc->noise_gain = tmp + 1;
        }
        break;

The generic TLV bound check (ptr + len > end, if_iwn.c:8280) accepts any len, including 0..3 — but the case unconditionally loads 4 bytes at ptr. When a PHY_CALIB TLV with len < 4 sits at the end of the firmware image, the load reads up to 4 bytes past the end of the kernel heap allocation holding the image (fw->data from firmware_get(), if_iwn.c:8375-8385). The sibling case IWN_FW_TLV_FLAGS (if_iwn.c:8327-8331) shows the intended pattern — it rejects len < sizeof(uint32_t).

What this pack proves

iwn_tlv_oob.c is a line-for-line copy of the parsing loop of iwn_read_firmware_tlv() (if_iwn.c:8271-8358; diagnostics dropped, sc-> fields modelled as locals). The crafted image is 96 bytes: 88-byte TLV header + one 8-byte TLV (type=15 PHY_CALIB, alt=0, len=0) ending exactly at the end of the buffer.

• guard-page mode (default): the image is placed flush against a PROT_NONE page → the 4-byte load at end faults: SIGSEGV, exit 139, deterministic 4/4 runs.
• ASAN mode: provided for environments with libasan (the audit guest's base gcc 8.3 has none — cannot find -lasan — so guard mode is primary).
• fixed variant (iwn_tlv_oob_fixed.c): adds the one-line guard if (len < sizeof(uint32_t)) break; (mirroring the FLAGS case). It parses the same image and returns cleanly — no fault (see run.log). This is the fix diff validated at harness level.

Build / run (on the DragonFly guest)

cc -O2 -Wall -o iwn_tlv_oob        iwn_tlv_oob.c
cc -O2 -Wall -o iwn_tlv_oob_fixed  iwn_tlv_oob_fixed.c
./iwn_tlv_oob guard        # expect: exit 139 (SIGSEGV at guard page)
./iwn_tlv_oob_fixed guard  # expect: clean return, no fault

Impact

Kernel heap OOB read of ≤4 bytes; the value only conditions sc->reset_noise_gain / sc->noise_gain (calibration command codes sent to the NIC) — no demonstrated path back to userspace. Attacker = whoever controls the firmware file (/boot/firmware/iwn*-fw, root-installed) or a corrupted download. Severity Low, but it is a genuine memory-safety defect and a correctness bug (garbage calib codes).

Fix

fix.diff — add the same length guard the FLAGS case already has.

DF-3577 — VERDICT

Status: reproduced (parser logic exercised verbatim at userland, fault deterministic). Impact ceiling on its own: none demonstrated beyond the OOB read (Low). Confidence: certain.

Root cause

iwn_read_firmware_tlv() walks TLVs with the single generic bound check

ptr += sizeof (*tlv);
if (ptr + len > end)          /* if_iwn.c:8280 — accepts len == 0..3 */
        return EINVAL;

and then dispatches on tlv->type. The IWN_FW_TLV_PHY_CALIB case (if_iwn.c:8315-8320) executes tmp = le32toh(*ptr) without checking len >= 4, so a TLV whose payload is shorter than 4 bytes — or has zero length and terminates the image — makes the 4-byte load run past end (the end of the firmware image resident in a kernel heap buffer obtained from firmware_get(), if_iwn.c:8375-8385). The IWN_FW_TLV_FLAGS case (if_iwn.c:8327-8331) proves the author knew the pattern: it rejects len < sizeof(uint32_t) and len % sizeof(uint32_t) != 0.

The parser runs at every ifconfig wlan0 up (iwn_init_locked → iwn_read_firmware → iwn_read_firmware_tlv, if_iwn.c:8933→8362→8397).

Reproduction

Harness iwn_tlv_oob.c copies the parsing loop line-for-line (structs from if_iwnreg.h:1721-1754). Crafted 96-byte image: valid TLV header (signature "IWL\n") + one TLV {type=PHY_CALIB(15), alt=0, len=0} as the final 8 bytes.

• baseline: image mapped to end flush at a PROT_NONE guard page → tmp = le32toh(*ptr) reads at end → SIGSEGV, exit 139 — 4/4 runs (run.log, run.2.log stress 3/3).
• ASAN variant exists; the guest's gcc 8.3 lacks libasan (ld.gold: cannot find -lasan), so guard-page mode is the recorded evidence. (build.log)
• fixed variant (iwn_tlv_oob_fixed.c, one added guard): same image parsed, returns cleanly, no fault — the fix eliminates the OOB at harness level. Kernel-level fix validation is impossible on this guest (no iwn hardware to load a patched kernel for), hence fix_status=not_testable with harness-level baseline/patched evidence recorded.

Why this is faithful

The vulnerable code is pure parsing over a kernel-resident buffer; the harness executes the identical statements on an identical input. The only difference is the allocator (kmalloc vs malloc/mmap), which affects only whether the OOB hits unmapped memory — the read past end is the defect, and it is unconditional.

Exploit chain

None developed: the 4 adjacent-heap bytes only influence calibration command codes sent to the radio. No userspace-visible disclosure path exists in the driver. Reported as a memory-safety defect (CWE-125) with Low impact.

Fix

fix.diff: mirror the FLAGS-case guard:

    case IWN_FW_TLV_PHY_CALIB:
+       if (len < sizeof (uint32_t))
+           break;
        tmp = le32toh(*ptr);

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.