⬢ DragonFlyBSD Kernel Audit
DF-4307 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
  "finding_id": "DF-4307",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, hardware-gated. adw_intr() converts two device-written 32-bit carrier fields into kernel pointers with no validation: acbbotov(adw, responseq->areq_ba) at adwcam.c:1280 (acbbotov = acbs + raw u32, adwlib.h:773-777) yields the struct acb * that is then read (ccb = acb->ccb, queue fields), passed to callout_stop (adwcam.c:1295) and WRITTEN via adwfreeacbs LIST_REMOVE/SLIST_INSERT_HEAD (adwcam.c:133/142); carrierbotov(free_carrier->next_ba & ADW_NEXT_BA_MASK) at adwcam.c:1288-1289 (adwlib.h:800-804) advances responseq up to ~256MiB past the carrier array and adwcam.c:1290 writes free_carrier->next_ba through it (4-byte OOB write). The unbounded while at adwcam.c:1264 on the device-fed DONE bit additionally permits interrupt-context livelock. Trigger requires the Advansys RISC (buggy firmware, compromised HBA, or PCIe/DMA attacker) to emit a token outside [0, num_acbs*sizeof(struct acb)) / outside the carrier allocation \u2014 the exact threat class of accepted sibling findings DF-2412/2413/2414 (narrow driver ccb_infos walk) and DF-4151 (free_q_head sense DMA), here in the wide drivers CAM-layer completion path, which pass 1 missed behind the macro pointer arithmetic. No runtime reproduction possible: the audit guest has no Advansys PCI device (pciconf -l has no 10cd vendor; QEMU has no Advansys emulation) and the primitive needs device-issued DMA values; a userspace harness of the macros would be tautological. Bounds-check fix authored (fix.diff, patch-apply verified).",
  "exploit_chain": "Compromised/buggy Advansys HBA firmware (or PCIe DMA attacker) completes a carrier with areq_ba = u32 of its choice -> acb = adw->acbs + u32 -> OOB read of acb->ccb gives a near-arbitrary kernel pointer ccb -> callout_stop(ccb->ccb_h.timeout_ch) and adwfreeacb write through it (forged acb inserted on the driver free list for reuse) -> kernel memory corruption with a 4GiB-range, 32-bit-steerable offset from a known DMA-coherent allocation; device-fed next_ba gives a second, 28-bit-steerable OOB write. Device-gated: no unprivileged-software-only route.",
  "evidence": "findings/poc/DF-4307/VERDICT.md (path:line trace); the two unchecked inline conversions adwlib.h:773-777 and :800-804; sinks adwcam.c:1290/1294-1295/1332->133/142; guest hardware probe NO_ADVANNSYS in DF-4310 env session",
  "kernel_refs": [
    "sys/dev/disk/advansys/adwcam.c:1264",
    "sys/dev/disk/advansys/adwcam.c:1280",
    "sys/dev/disk/advansys/adwcam.c:1288",
    "sys/dev/disk/advansys/adwcam.c:1290",
    "sys/dev/disk/advansys/adwcam.c:1294",
    "sys/dev/disk/advansys/adwcam.c:1295",
    "sys/dev/disk/advansys/adwcam.c:1332",
    "sys/dev/disk/advansys/adwcam.c:133",
    "sys/dev/disk/advansys/adwcam.c:142",
    "sys/dev/disk/advansys/adwlib.h:773",
    "sys/dev/disk/advansys/adwlib.h:800",
    "sys/dev/disk/advansys/adwlib.h:399",
    "sys/dev/disk/advansys/adwmcode.h:106"
  ],
  "poc_changes": "No seed PoC (finding new in pass 2). No executable PoC possible without Advansys hardware; pack documents the source-level proof and the bounds-check fix.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Hardware-gated (no Advansys HBA in QEMU guest; pciconf has no vendor 10cd). Same device-fed-token class as accepted DF-2412/2413/2414/4151 for the narrow sibling. Sibling severity precedent: Medium (DF-2414).",
  "recommended_fix": "Validate areq_ba against num_acbs*sizeof(struct acb) (with alignment) and next_ba against the carrier allocation size in adw_intr before acbbotov/carrierbotov; on violation reset the bus and abandon the walk \u2014 see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch -p1 apply-verified); cannot be runtime-tested without Advansys hardware.",
  "fix_evidence": "findings/poc/DF-4307/fix.diff"
}