⬢ DragonFlyBSD Kernel Audit
DF-3574 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-3574",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "sym_action2() indexes np->target[ccb_h->target_id] and sym_lp(np,tp,ccb_h->target_lun) (sym_hipd.c:8048/8054/8076/8077 -> lunmp[lun] at 1269-1271) without the SYM_CONF_MAX_TARGET/MAX_LUN bounds check that sym_action (7501-7506) and sym_reset_dev (7438-7443) perform. A wild target/lun would OOB-read tinfo bytes into the caller-visible ccb_trans_settings (small info leak) and a wildcard LUN computes &lunmp[0xFFFF] and dereferences it (wild read). Every currently-constructible delivery path was traced (pass real-device paths; xptioctl func-code restrictions; XPT_SET intercepted by xpt_set_transfer_settings; the drivers wildcard-lun async path uses async_update=TRUE which skips both the GET round-trip and the sim_action call; phantom targets die at sym_actions SCSI_IO bounds check) \u2014 no reachable trigger exists today, and the guest has no 53C8xx HBA so the driver cannot even attach. Filed as defense-in-depth; fix.diff mirrors the sym_action check in the two TRAN_SETTINGS cases.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3574/VERDICT.md (full reachability trace with cam_xpt.c cites); findings/poc/DF-3574/fix.diff; findings/poc/DF-3574/env.txt (guest: sym.ko present, no PCI 53C8xx, cannot attach)",
  "kernel_refs": [
    "sys/dev/disk/sym/sym_hipd.c:8048",
    "sys/dev/disk/sym/sym_hipd.c:8054",
    "sys/dev/disk/sym/sym_hipd.c:8076",
    "sys/dev/disk/sym/sym_hipd.c:8077",
    "sys/dev/disk/sym/sym_hipd.c:1269",
    "sys/dev/disk/sym/sym_hipd.c:7501",
    "sys/dev/disk/sym/sym_hipd.c:7438",
    "sys/bus/cam/cam_xpt.c:3911",
    "sys/bus/cam/cam_xpt.c:3051"
  ],
  "poc_changes": "No PoC seed existed; no runnable trigger path exists (latent hardening gap) and the guest lacks sym hardware, so no PoC was authored. Environment probe recorded instead (env.txt).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 02:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "dfbsd-qemu/vm.sh run_root ls -l /boot/kernel/sym.ko; kldstat -v | grep -w sym; pciconf -l",
  "code_hash": "",
  "notes": "Pass-2 finding. Known pass-1 findings DF-1120 (buddy merge OOB) and DF-1121 (msgin[8] 1-byte DMA overflow) were re-confirmed present at sym_hipd.c:476-497 and sym_fw1.h/sym_fw2.h MSG_EXTENDED (MOVE of len bytes to msgin[2]) but NOT re-reported. Guest /dev/pass0 and /dev/xpt0 are 0600 root:operator, confirming the CAM ioctl surface is privileged.",
  "recommended_fix": "Add sym_action()-style target/lun bounds checks to the XPT_SET_TRAN_SETTINGS and XPT_GET_TRAN_SETTINGS cases of sym_action2() (see findings/poc/DF-3574/fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (never applied). Not build-validated: the fix guards a latent path and the guest has no sym adapter to attach a patched kernel; the change is mechanical, mirroring sym_hipd.c:7501-7506. A blanket early-return in sym_action2 was deliberately avoided because XPT_RESET_BUS legitimately arrives with a wildcard target from /dev/xpt0.",
  "fix_evidence": "findings/poc/DF-3574/fix.diff"
}