DF-4776
am7990_start_locked feeds unbounded mbuf chains into lance_put, memcpy'ing into the fixed LEBLEN(1522)-byte TX slot with no clamp (dead-code twin of DF-4746)
Summary
No pkthdr.len bound between dequeue and lance_put's unbounded chain copy; tmd2=-len arms a two's-complement length wider than the buffer. Dead code (no caller) + root-only >LEBLEN injection vector (BPF) = defense-in-depth. Clamp-at-dequeue fix (fixes both twins).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4776 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 812 B | view raw |
Fix verification
not_testableper-fix-DF-4776
Confirmed kernel references
Detail
Exploit chain
n/a (dead code + root-only vector)
Evidence (decisive lines)
findings/poc/DF-4776/ (this verdict)
Verdict
Source-certain dead-code twin of DF-4746: am7990_start_locked calls lance_put with no LEBLEN clamp (lance.c:309-325 unbounded chain memcpy) and tmd.tmd2=-len arms a two's-complement length. Dead code (no am7990_config caller); even live, the overrun stays within/past the dedicated bus_dmamem shared region and the only >LEBLEN injection vector is root-only BPF write. Defense-in-depth pkthdr.len guard fix.
No comments yet.