⬢ DragonFlyBSD Kernel Audit
DF-4330 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-4330",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED on the guest with the unmodified kernel source: mr_update_span_set (mrsas_fp.c:949-959) writes firmware-indexed strip_offset[count] for count < fw spanDepth (up to 255) into u_int8_t strip_offset[8], cascading across LD_SPAN_SETs and, for LD 63, past the end of sc->log_to_span[64] - the last member of struct mrsas_softc - into adjacent kernel heap. The drivers only map validation (totalSize equality, mrsas_fp.c:257-265) accepts the malicious map (returned 0) and 40 guard bytes past a correctly-sized softc were overwritten with the exact accumulated fw spanRowDataSize sum. Ceiling: kernel memory corruption authored by a malicious/compromised MegaRAID firmware or PCIe device (same precondition as DF-1528, but a WRITE primitive); in-guest privesc not reachable because no mrsas HBA exists to host the DMA source.",
  "exploit_chain": "compromised fw/PCIe device -> MR_DCMD_LD_MAP_GET_INFO DMA with spanDepth>8 for an exposed LD -> MR_ValidateMapInfo accepts (totalSize forged) -> mr_update_span_set strip_offset[] linear OOB write past sc->log_to_span[] into adjacent kernel heap with fw-chosen bytes (demonstrated: 40 bytes, values 0x00-0x3f running sum) -> corrupt neighbor objects/interior span_set geometry (feeds later divisors/indices). uid0 chain not developable without the HBA (no in-situ heap to shape).",
  "evidence": "run.log: MR_ValidateMapInfo returned 0 + DF-4330 CONFIRMED: OOB WRITE past end of sc->log_to_span[64] + guard integrity: 40/4096 bytes clobbered; fix_run.log: benign map still accepted (no regression), malicious map rejected with guard 0/4096; serial_decisive.log: full console record; VERDICT.md: line-by-line trace",
  "kernel_refs": [
    "sys/dev/raid/mrsas/mrsas_fp.c:955",
    "sys/dev/raid/mrsas/mrsas_fp.c:949",
    "sys/dev/raid/mrsas/mrsas_fp.c:937",
    "sys/dev/raid/mrsas/mrsas_fp.c:257",
    "sys/dev/raid/mrsas/mrsas_fp.c:267",
    "sys/dev/raid/mrsas/mrsas.h:733",
    "sys/dev/raid/mrsas/mrsas.h:2424",
    "sys/dev/raid/mrsas/mrsas.c:1757",
    "sys/dev/raid/mrsas/mrsas.c:2961"
  ],
  "poc_changes": "probe embeds the guests unmodified /usr/src mrsas_fp.c with symbols renamed (rename.h) to avoid collision with the built-in driver; calls the real MR_ValidateMapInfo on a real mrsas_softc with a 0xAA guard behind log_to_span; craft: ldTgtIdToLd 0xFF-filled with [63]=63 (real-fw convention), spanDepth=64, consistent totalSize, 0x01 slack for the DF-1528-class OOB reads",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 95,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (guest, root): make in /root/fp4330 and /root/fp4330_fixed with SRCS=fp_probe.c mrsas_fp.c, -include rename.h",
  "run_cmd": "kldload /root/fp4330/fp_probe.ko; sysctl hw.fp_probe_run=0; sysctl hw.fp_probe_run=1",
  "code_hash": "b30cab73ea2b04904c4c7393b68a37b526d79d065ae0ee3474aaf5f2829e2df7",
  "notes": "Impact field dos = demonstrated ceiling on this guest (controlled corruption proof, panic shown for sibling DF-4331); the class is kernel memory corruption (bucket memcorrupt). Fix validated at module level: identical file+flags+entry as the in-kernel build; full-kernel rebuild adds no code-path coverage.",
  "recommended_fix": "Validate per-LD geometry in MR_ValidateMapInfo before building spansets: reject maps with spanDepth==0 or >MAX_RAIDMAP_SPAN_DEPTH, noElements==0 or >MAX_QUAD_DEPTH, any quad diff==0, or spanRowSize==0 on RAID 0/5/6 (see fix.diff)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched mrsas_fp.c (fix.diff) rejects the spanDepth=64 map at MR_ValidateMapInfo (returns 1, invalid RAID map geometry), guard 0/4096 - OOB write eliminated; benign mode-0 map still accepted (returned 0, spansets built) - no regression; DF-4331 input (diff=0) also rejected without panic",
  "fix_evidence": "fix_run.log lines: invalid RAID map geometry (ld/span/quad), rejecting map + MR_ValidateMapInfo returned 1 + guard integrity: 0/4096 for mode 1 AND mode 2; mode 0: returned 0 + sanity OK",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
}