DF-4320 — Missing privilege check on SIOCGATHDIAG exposes the full HAL diagnostic interface (arbitrary device MMIO read/write, 802.11 keycache disclosure, NULL-deref panics)

Build

cc -O2 -Wall -o poc poc.c

(Any DragonFly host; plain POSIX userland, no privileges needed.)

Run

./poc            # probes every interface with SIOCGATHDIAG as the invoking user

Expected

• Vulnerable system (kernel built with options ATH_DIAGAPI, an ath(4) wlan interface present, run as a plain user): prints SETREGS : SUCCESS (an arbitrary device register write was accepted from an unprivileged uid) and/or REGS-dump: SUCCESS (device register dump, including the WEP/TKIP keycache registers at 0x9800+, handed to an unprivileged uid). No EPERM is ever produced — the DragonFly source has no privilege gate anywhere on the dispatch path (socket → ifioctl default → ieee80211_ioctl default → ath_ioctl case SIOCGATHDIAG → ath_ioctl_diag).
• Stock X86_64_GENERIC (no ATH_DIAGAPI): every probe returns ENOTTY/EINVAL — the ioctl case is not compiled into the kernel (verified: nm /boot/kernel/if_ath.ko | grep ath_ioctl_diag → empty). On the audit QEMU guest additionally no Atheros NIC exists (virtio-only PCI bus), so the wlan dispatch is never reached.

Static proof (decisive on any host)

• sys/dev/netif/ath/ath/if_ath_ioctl.c:288 — the neighboring ioctl SIOCZATHSTATS does check caps_priv_check_self(SYSCAP_NODRIVER).
• sys/dev/netif/ath/ath/if_ath_ioctl.c:299-302 — SIOCGATHDIAG / SIOCGATHPHYERR call ath_ioctl_diag/ath_ioctl_phyerr directly with no check. FreeBSD upstream gates the identical cases with priv_check(curthread, PRIV_DRIVER).
• sys/netproto/802_11/wlan/ieee80211_ioctl.c:3516-3520 — unknown ioctls are passed to the driver ("Pass unknown ioctls first to the driver") with no privilege check.
• sys/dev/netif/ath/ath_hal/ah.c:878-935 — what the gate would be protecting: HAL_DIAG_SETREGS (arbitrary addr,value MMIO writes, unconditional), HAL_DIAG_REGS (arbitrary register-range dump — includes keycache), HAL_DIAG_EEREAD, plus (under AH_PRIVATE_DIAG) SETKEY/RESETKEY/EEWRITE.

Files

• poc.c — the probe (struct layouts mirrored 1:1 from if_athioctl.h).
• run.log — guest run (default kernel: ENOTTY/EINVAL as predicted).
• static_check.log — guest kernel/module symbol + PCI evidence.
• env.txt — guest environment.
• fix.diff — the one-hunk fix.

DF-4320 — VERDICT

Status: inconclusive at kernel level (feature absent on the audit guest); the missing privilege gate itself is certain from source, fully traced.

What the finding claims

SIOCGATHDIAG (the ath(4) HAL diagnostic ioctl) is dispatched to ath_ioctl_diag() without any privilege check on DragonFly:

sys/dev/netif/ath/ath/if_ath_ioctl.c:285-297   SIOCZATHSTATS *does* check
                                              caps_priv_check_self(SYSCAP_NODRIVER)   :288
sys/dev/netif/ath/ath/if_ath_ioctl.c:299-300   case SIOCGATHDIAG:
                                                return (ath_ioctl_diag(sc, data));  <-- NO check
sys/dev/netif/ath/ath/if_ath_ioctl.c:301-302   case SIOCGATHPHYERR: same             <-- NO check

The full unprivileged dispatch chain (traced, no gate anywhere):

1. ioctl(2) on a datagram socket → sys/net/if.c:2409-2415 default → so_pru_control_direct (unknown driver ioctl passed through);
2. sys/netproto/802_11/wlan/ieee80211_ioctl.c:3516-3520 default — "Pass unknown ioctls first to the driver" → ic->ic_ioctl = ath_ioctl;
3. ath_ioctl case SIOCGATHDIAG → ath_ioctl_diag (if_ath_ioctl.c:170-235) — copyin of attacker ad_in_size/ad_out_size buffers, then ath_hal_getdiagstate(ah, id, indata, insize, &outdata, &outsize);
4. sys/dev/netif/ath/ath_hal/ah.c:878-935 — unconditional handlers: * HAL_DIAG_SETREGS (33): ath_hal_setregs() — arbitrary device MMIO writes with attacker-supplied addr,value pairs, no validation at all (ah.c:888-891); * HAL_DIAG_REGS (13): ath_hal_getregdump() — arbitrary register range dump returned to userland; the keycache registers (AR_KEYTABLE_KEYn, 0x9800+, ar5212reg.h) hold installed WEP/TKIP key material in plaintext → 802.11 key disclosure to any local user; * HAL_DIAG_EEREAD (17): arbitrary EEPROM word read. Plus NULL-deref panics with the ATH_DIAG_IN/ATH_DIAG_DYN flag bits unset: getregdump(ah, NULL, NULL, attacker_outsize) / ath_hal_setregs(ah, NULL, argsize) dereference NULL (ah.c:848-856/865-870 with indata == NULL) — trivial unprivileged panic on a vulnerable config. The ar5212-specific handlers behind ar5212GetDiagState (ar5212_misc.c:1049-1126) add HAL_DIAG_ANI_CMD → ar5212AniControl with unchecked cmd, which NULL-derefs params->maxNoiseImmunityLevel when no ANI state exists (ar5212_ani.c:230-243).

FreeBSD upstream gates the identical cases with priv_check(curthread, PRIV_DRIVER); DragonFly's port kept the check for SIOCZATHSTATS only (the caps_priv_check_self at :288) and dropped it for the two DIAGAPI ioctls.

Why it is not kernel-reproducible on THIS guest (and what was verified instead)

• The guest kernel is X86_64_GENERIC (DragonFly 6.5-DEVELOPMENT #0 ... /usr/obj/usr/src/sys/X86_64_GENERIC), which does not include options ATH_DIAGAPI (sys/config/X86_64_GENERIC — no ATH_DIAGAPI; only LINT64 lists it at :1121). The whole #ifdef ATH_DIAGAPI block — including ath_ioctl_diag — is not compiled: nm /boot/kernel/if_ath.ko | grep ath_ioctl_diag → no symbol (see static_check.log).
• The guest has no Atheros NIC (virtio-only PCI bus, pciconf -l in env.txt), so even a recompiled kernel could not be driven into the HAL path without hardware.

What WAS verified on the guest:

• poc (unprivileged, uid=1001) issued real SIOCGATHDIAG ioctls with a HAL_DIAG_SETREGS payload and a HAL_DIAG_REGS keycache-dump payload on every interface: non-wlan interfaces answer EINVAL (ether layer), i.e. no privilege gate was hit — and none exists in the source path (run.log).
• Static evidence that the HAL side handlers are compiled unconditionally into ath_hal.ko (disassembly of ath_hal_getdiagstate at +0x67b0 shows comparisons against diag codes 13 (REGS), 17 (EEREAD), 29 (FATALERR), 30 (11NCOMPAT), 33 (SETREGS)) — the only missing piece on a stock system is the ioctl case in if_ath.ko, which any options ATH_DIAGAPI kernel build turns on.

Exploit chain (on a kernel built with options ATH_DIAGAPI + ath NIC)

unprivileged local user
  → socket(AF_INET,SOCK_DGRAM) + ioctl(SIOCGATHDIAG, {ad_id=HAL_DIAG_REGS|IN|DYN,
      ad_in_data=[{0x9800,0x983f},...], ad_out_size=4096})
  → copyout of keycache registers → recover WEP/TKIP group/pairwise keys
  → (or) ad_id=HAL_DIAG_SETREGS, write arbitrary device registers
  → (or) ad_id=HAL_DIAG_ANI_CMD, NULL-deref panic
  → (or) HAL_DIAG_REGS with crafted sizes → DF-4321 heap overflow → code exec

Bottom line

Certain source-level vulnerability (CWE-862), unconditionally missing gate whose sibling ioctl demonstrates the intended pattern in the same switch. Exploitation requires a kernel built with options ATH_DIAGAPI (not in default GENERIC) and an ath(4) device — therefore Medium severity per the project rubric ("requires unusual config"), with High impact on such configurations. Not reproducible on the audit guest (feature absent); fix.diff adds the gate mirroring :288.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.