⬢ DragonFlyBSD Kernel Audit
DF-5175 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5175",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Untested at runtime because the trigger requires a malicious 16-bit PCMCIA card in a physical slot and the QEMU verification guest has no pccard/cbb controller; the defect itself is fully proven by source trace. The pccard bus returns the CIS-declared I/O window verbatim to ata_pccard_attach (pccard.c:1121-1149, window sized at pccard.c:429-449 from raw CIS bytes at pccard_cis.c:1074-1092), and ata-card.c wires register offsets without validating coverage: window lengths 9..14 put ATA_CONTROL at fixed offset 14 (ata-card.c:103-106) outside the allocation, lengths 1..7 leave primary register offsets 0..7 (ata-card.c:93-96) outside it; reads are aliased through ATA_ALTSTAT (ata-all.c:734-735). Result is 1-byte out-of-allocation port I/O (near-fixed control-byte writes, status reads) at fixed offsets near the window \u2014 adjacent-host-device perturbation at worst, no kernel memory access, physical access required. Low severity; Phase V PoC/fix-build skipped per audit contract for Low hardening findings; fix.diff authored and git-apply-verified against the pristine tree.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5175/VERDICT.md (hop-by-hop path:line trace); cis_window_trace.md (chain + reference CIS geometry); fix.diff (applies clean, verified with git apply --check on a pristine copy)",
  "kernel_refs": [
    "sys/dev/disk/nata/ata-card.c:93-96",
    "sys/dev/disk/nata/ata-card.c:103-106",
    "sys/dev/disk/nata/ata-card.c:87-90",
    "sys/dev/disk/nata/ata-card.c:63-67",
    "sys/bus/pccard/pccard.c:429-449",
    "sys/bus/pccard/pccard.c:1121-1149",
    "sys/bus/pccard/pccard_cis.c:1074-1092",
    "sys/dev/disk/nata/ata-all.c:723-735",
    "sys/dev/disk/nata/ata-all.h:679-712"
  ],
  "poc_changes": "n/a \u2014 no seeded PoC existed; the pack documents a code-level proof chain plus reference CIS geometry for hardware testing instead of an executable",
  "attempts": 0,
  "guest_uname": "n/a (no guest run: trigger needs physical PCMCIA hardware; guest has no pccard controller)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "f94ae7b28690bb8341057d928f74fd22aab6001ce34c3ae523e39ed84573f0e8",
  "notes": "Distinct from known DF-2173 (resource leak on attach failure at ata-card.c:125-128): DF-5175 is out-of-allocation port I/O on the SUCCESS path from trusting CIS window geometry. Negative-space verified: PIO data transfers touch only offset 0 repeatedly (FIFO semantics, in-bounds); CardBus does not route through this file (pccard bus only, ata-card.c:163); detach release logic correct for both wiring branches (ata-card.c:138-144).",
  "recommended_fix": "Validate rman_get_size(io) in ata_pccard_attach: fail closed for windows < ATA_IOSIZE, and only use the shared control-at-offset-14 layout when size >= ATA_PCCARD_CTLOFFSET + ATA_CTLIOSIZE (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff authored against read-only sys/ and git-apply-verified on a pristine copy; runtime fix validation impossible for the same hardware reason as the trigger (no PCMCIA controller in any available environment); changes fail the attach closed for undersized windows and make the shared-control branch require a window that actually covers offset 14",
  "fix_evidence": "findings/poc/DF-5175/fix.diff; verified APPLIES_CLEAN + MATCHES_INTENDED against a pristine copy of sys/dev/disk/nata/ata-card.c"
}