HAL_DIAG_ANI_CURRENT copies out the internal ar5212AniState including the kernel 'params' pointer: kernel heap address disclosure
Summary
The diag path sizes the copy from the internal struct (sizeof(ar5212AniState)) whose final member is the kernel 'params' pointer, instead of the exported pointer-free prefix HAL_ANI_STATE defines - leaking 8 bytes of kernel heap address per call via ioctl copyout. Same missing-priv-check gates as DF-2059/4320; informational on KASLR-less DFly. offsetof-prefix fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4527 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 2.2 KB | view raw |
Fix verification
not_testablenot applicable (skipped, Info)
Confirmed kernel references
Detail
Evidence (decisive lines)
code trace only (no pack; Info finding, skipped per Phase V policy)
Verified recommended fix
Copy out only the exported prefix of ar5212AniState (up to listenTime), not the full internal struct containing the params pointer.
Verdict
Info-severity kernel-address disclosure, hardware-gated (no ath radio on the audit guest); Phase V skipped per policy for Info findings. Code trace: HAL_DIAG_ANI_CURRENT (ar5212_misc.c:1081-1085, reached from ar5416 via ar5416GetDiagState -> ar5212GetDiagState, ar5416_misc.c:557) exports sizeof(struct ar5212AniState) bytes of the internal per-channel ANI state; that struct's LAST member is the kernel pointer 'const struct ar5212AniParams *params' (ar5212.h:181-198), which ath_ioctl_diag() then copyout()s verbatim to userspace (if_ath_ioctl.c:214-219) — an 8-byte kernel heap address disclosure (offset of &ahp->ah_aniParams24/5 inside the ath_hal_5416 softc) on every SIOCGATHDIAG HAL_DIAG_ANI_CURRENT call. The exported HAL_ANI_STATE type in ah.h deliberately stops before the pointer; the diag path sizes the copy from the internal struct instead. Same ATH_DIAGAPI + missing-priv-check (DF-2059/DF-4320) gates as DF-4526; no KASLR on current DFly keeps impact informational.
No comments yet.