Uninitialized kernel stack shipped to the NIC: mxge_close's ETHERNET_DOWN cmd (12B), mxge_dummy_rdma (40 of 64 PIO bytes), mxge_load_firmware boot handoff (36 of 64 PIO bytes)
Summary
Three loci write uninitialized stack to device SRAM: mxge_close passes an uninitialized mxge_cmd_t to MXGEFW_CMD_ETHERNET_DOWN (12 bytes); mxge_dummy_rdma initializes only 24 of the 64 PIO-copied bytes; the boot-handoff block initializes 28 of 64. mxge_send_cmd's own buffer is fully initialized - only these three leak. Device-directed disclosure only (stale stack contents readable by a hostile NIC); zeroization hygiene. Three bzero() fix git-apply-clean.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3722 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 1.4 KB | ↓ raw | |
| VERDICT.md | — | 951 B | ↓ raw | |
| fix.diff | — | 859 B | view raw | |
| verdict.json | — | 2.0 KB | view raw | |
| manifest.json | — | 724 B | view raw | |
| env.txt | — | 583 B | view raw |
DF-3722 — Uninitialized kernel stack disclosed to the NIC (three loci)
Hardening finding (Info)
sys/dev/netif/mxge/if_mxge.c sends uninitialized kernel stack bytes to
the device in three places:
mxge_close():3516-3528 —mxge_cmd_t cmd;(:3517) is declared uninitialized and passed tomxge_send_cmd(sc, MXGEFW_CMD_ETHERNET_DOWN, &cmd)(:3526);mxge_send_cmdcopiescmd.data0..data2(12 bytes of stack garbage) into the NIC SRAM command block (:797-800).mxge_dummy_rdma():735-782 —char buf_bytes[72](:738); onlybuf[0..5](24 bytes) are initialized (:758-765) beforemxge_pio_copy(submit, buf, 64)(:769) ships all 64 bytes toMXGEFW_BOOT_DUMMY_RDMA.mxge_load_firmware():899-970 —char buf_bytes[72](:904); onlybuf[0..6](28 bytes) initialized (:954-967) beforemxge_pio_copy(submit, buf, 64)(:970) ships the boot-handoff block.
(The command path mxge_send_cmd itself (:788-809) fully initializes its
stack buffer — this finding is only the three loci above.)
Impact is disclosure of stale kernel stack contents to the device (and thus to a hostile NIC's logs/DMA), not directly to userspace. Info-grade hygiene; same class as the zeroization gaps tracked for other drivers.
Fix
fix.diff: bzero() the stack buffers before filling (three one-liners;
git-apply clean).
DF-3722 VERDICT
Status: inconclusive (hardware-gated; Info-grade hardening), confidence: certain source-level.
Three loci ship uninitialized kernel stack to the NIC: mxge_close's uninitialized mxge_cmd_t (:3517/:3526 -> 12 bytes), mxge_dummy_rdma's 24-of-64 initialized buffer (:738/:758-765/:769), mxge_load_firmware's 28-of-64 initialized handoff buffer (:904/:954-967/:970). Disclosure is device-directed only. Fix is three bzero() calls (fix.diff, git-apply clean). Not runtime-testable: needs a Myricom NIC to observe the SRAM image; skipped guest verification per Low/Info convention.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix.diff git apply --check clean; trivial hygiene change, not buildable without mxge hardware.
findings/poc/DF-3722/fix.diff
Confirmed kernel references
Detail
Evidence (decisive lines)
findings/poc/DF-3722/VERDICT.md; fix.diff (three bzero() calls, git-apply clean); env.txt
PoC changes
No seed PoC; hardening finding, no guest run.
Verified recommended fix
bzero the stack buffers before filling (mxge_close cmd; both 72-byte pio buffers).
Verdict
Source-certain, hardware-gated, Info-grade: if_mxge.c sends uninitialized kernel stack to the device in three places - mxge_close passes an uninitialized mxge_cmd_t to MXGEFW_CMD_ETHERNET_DOWN (:3517/:3526, 12 bytes via mxge_send_cmd :797-800), mxge_dummy_rdma PIO-copies 64 bytes of a stack buffer of which only 24 are initialized (:738/:758-765/:769), and mxge_load_firmware's boot handoff copies 64 bytes of which only 28 are initialized (:904/:954-967/:970). Device-directed disclosure only (stale stack contents observable by a hostile NIC); not userspace-visible. Guest has no Myricom device; verification skipped per Low/Info convention.
No comments yet.