⬢ DragonFlyBSD Kernel Audit
DF-3812 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-3812",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "isp_add_wwn_entry (isp_library.c:2398) and isp_del_wwn_entry (:2529) index FCPARAM(isp, chan) with no chan < isp_nchan check, unlike all four siblings in the same file (:2304/:2327/:2350/:512); isp_del_all_wwn_entries uses > instead of >= (:2580). On MULTI-ID firmware chan is the raw 8-bit in_vpidx from the firmware-generated IN24XX_ELS_RCVD notify (isp_freebsd.c:2627 via ispmbox.h:861-862), so a vpidx beyond the 1-2 channel fcparam allocation (isp_pci.c:824-832) yields a kernel-heap OOB pointer through which the function reads isp_tgt_map[nphdl] and writes a portdb entry (target_mode=1, handle=nphdl, portid=s_id, 8-byte remote-controlled port_wwn) plus fcp->isp_tgt_map[nphdl]=i+1 - multi-field OOB write at ~68KB granularity up to ~17.8MB past the block (arithmetic demonstrated on the guest, see build.log). Not triggered in vivo: the audit guest has no QLogic HBA (pciconf grep count 0), so the driver path is unreachable there; verdict inconclusive = source-certain, hardware-absent. Trust model matches accepted DF-2471/DF-3582/DF-3583 (card-controlled fields); rated Medium because this path writes remote-controlled data OOB.",
  "exploit_chain": "compromised/buggy HBA firmware (or PCIe DMA) emits IN24XX_ELS_RCVD PLOGI/PRLI notify with in_vpidx > nchan -> chan unchecked into FCPARAM -> OOB heap write of remote WWN/portid + tgt_map entry -> arbitrary heap corruption groomable toward uid0; chain not executed (no hardware)",
  "evidence": "findings/poc/DF-3812/VERDICT.md (full trace with path:line), findings/poc/DF-3812/build.log (guest-built offset demonstrator: vpidx 52 -> 3.55MB, 255 -> 17.77MB past block), findings/poc/DF-3812/vpidx_oob_arith.c, findings/poc/DF-3812/env.txt",
  "kernel_refs": [
    "sys/dev/disk/isp/isp_library.c:2398",
    "sys/dev/disk/isp/isp_library.c:2497",
    "sys/dev/disk/isp/isp_library.c:2529",
    "sys/dev/disk/isp/isp_library.c:2580",
    "sys/dev/disk/isp/isp_freebsd.c:2627",
    "sys/dev/disk/isp/isp_freebsd.c:2677",
    "sys/dev/disk/isp/ispmbox.h:861",
    "sys/dev/disk/isp/ispvar.h:644",
    "sys/dev/disk/isp/isp_pci.c:824"
  ],
  "poc_changes": "n/a - pack authored fresh; demonstrator written to quantify OOB offsets since in-vivo trigger impossible",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 4,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -o /tmp/vpidx /tmp/vpidx.c && /tmp/vpidx (guest, unprivileged)",
  "run_cmd": "/tmp/vpidx",
  "code_hash": "sha256:3e3613547079b3036e7e93e097a4b4f3221f573c37675f24ffb3d113148b8691",
  "notes": "Pass-2 cross-file lead (a) resolved: isp_find_handle contract is sound (seq-checked handles, destroy clears slots). Leads (b)(c)(d) negative: library-side atio/atio2/atio7 and 24xx-response copies are fixed-size struct walks; no isp_get_stats here; ridacq union guarded. Attempt 1 = guest arithmetic demonstrator (built+ran clean); in-vivo attempt impossible (no QLogic HBA).",
  "recommended_fix": "Add chan >= isp_nchan guards to isp_add_wwn_entry/isp_del_wwn_entry and fix isp_del_all_wwn_entries > to >= (isp_library.c)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: baseline never reproduced (no QLogic hardware on guest)",
  "fix_evidence": ""
}