DF-4514
ath_lna_div: dead ath_lna_div_ioctl() unconditionally copyouts uninitialized kernel heap (kmalloc without M_ZERO, executed even after EINVAL) - latent uninitialized-memory disclosure if ever wired up
Summary
Zero call sites tree-wide (the DF port never wired FreeBSD's dispatch), but the body is a landmine: ATH_DIAG_DYN allocates without M_ZERO, the empty switch yields EINVAL for everything, and the trailing copyout still executes - chosen-length uninitialized kernel-heap disclosure. Realistic wiring hazard given the diag ioctls themselves lacked priv checks (DF-4320). M_ZERO + copyout-on-success fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4514 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 953 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
not_testable: Hyper-V/ath hardware absent from guest
fix in finding markdown
per-fix-DF-4514
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
kmalloc without M_ZERO + copyout executed even after the empty-switch EINVAL. M_ZERO + copyout-only-on-success fix.
Verdict
not_run: zero callers tree-wide; Info hardening
No comments yet.