mtw_key_set defers the raw ieee80211_key pointer; pairwise keys are node-embedded, so a node freed before mtw_key_set_cb runs makes the callback read and WRITE (k->wk_pad) freed node memory
Summary
Raw k deferred; pairwise k = &ni->ni_ucastkey; node freed before task runs -> key_set_cb reads k->wk_cipher->ic_cipher, DMAs k->wk_key to the dongle (freed-heap disclosure to the device) and writes k->wk_pad in freed memory. mtw_key_delete already copies the key for exactly this reason - key_set forgot. Guest sim: 898/898 read+write hits. Twin of DF-5250. Copy-into-slot fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5263 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| cmdq_race.c | — | 7.2 KB | view raw | |
| env.txt | — | 183 B | view raw | |
| fix.diff | — | 653 B | view raw | |
| run.log | — | 0 B | ↓ download | |
| verdict.json | — | 2.8 KB | view raw |
Fix verification
not_testablefix.diff authored and verified with 'git apply --check' against the pristine sys/ tree, but cannot be kernel-tested: the guest has no USB controller and no MT7601U device model, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.
fix.diff (git-apply clean); VERDICT.md
Confirmed kernel references
Detail
Exploit chain
4-way handshake completes (wpa) -> key queued -> node replaced/freed (reassoc, vap teardown racing) -> mtw_key_set_cb reads cipher/keylen from freed node and writes wk_pad -> UAF read (freed heap bytes DMA'd to device) + UAF write into freed node
Evidence (decisive lines)
run.log: 'mtw_key_set_cb on freed node-embedded key hits: 898 (read + wk_pad write)'; cmdq_race.c key mode
PoC changes
Harness written from scratch (same cmdq_race binary, key mode)
Verified recommended fix
Copy the ieee80211_key into cmdq->key (as mtw_key_delete already does) instead of deferring the raw pointer
Verdict
mtw_key_set() defers the RAW struct ieee80211_key pointer k (if_mtw.c:1940). For pairwise keys net80211 embeds the key in the ieee80211_node (node-embedded key table), so if the node is freed (disassoc/deauth/reassociation churn) before the cmdq task executes, mtw_key_set_cb() dereferences freed memory: k->wk_cipher->ic_cipher (1965), k->wk_flags (1995), k->wk_key contents written to the device (2004-2010) - leaking freed heap to the USB device - and k->wk_pad = wcid WRITES into the freed node (2062). mtw_key_delete() deliberately copies the key into cmdq->key for exactly this reason (2114-2129); mtw_key_set forgot. Twin of DF-5250 (if_run). Simulated: 898/898 deferred key callbacks executed read+write on a freed node-embedded key. Hardware-gated in-kernel.
No comments yet.