DF-4670
ar5416GetDiagState: HAL_DIAG_CHECK_HANGS dereferences args==NULL when the ioctl omits ATH_DIAG_IN — NULL-deref panic (DF-1521 sibling, in-file)
Summary
Only argsize is validated; ath_ioctl_diag leaves indata NULL whenever ATH_DIAG_IN is cleared while ad_in_size passes through - the case reads *(int*)NULL: kernel panic. Unpriv-reachable exactly while DF-4320's missing priv check stands; degrades to root DoS after. Same family as DF-1521 (ah.c); ANI/SETREGS siblings noted. Validate-args!=NULL fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4670 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
validate args!=NULL alongside argsize (and shield the whole family in ath_ioctl_diag) in finding markdown
per-fix-DF-4670
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
argsize-only validation for HAL_DIAG_CHECK_HANGS; ath_ioctl_diag leaves indata NULL when ATH_DIAG_IN is cleared while ad_in_size passes through - *(int*)NULL read. DF-1521 sibling (ah.c EEREAD/REGS) - this is the ar5416_misc.c instance; ANI/SETREGS siblings noted. No ath hardware on guest.
Verdict
not_run: Low hardware-gated (no ath NIC on guest); source-certain
No comments yet.