cdcheckmedia unbounded TOC entry count overflows softc->toc.entries[100] -> heap corruption
Summary
cdcheckmedia at scsi_cd.c:2947 num_entries=(toch->ending_track - toch->starting_track)+2 NO cap. :2952 toclen=num_entries*sizeof(cd_toc_entry). :2954 cdreadtoc forwards toclen+4 as DMA length into &softc->toc (sizeof(cd_tocdata)=4+100*8=804 bytes). ending_track=255 starting_track=0 -> num_entries=257 -> DMA writes 257*8+4=2060 bytes into 804-byte buffer -> 1248 bytes heap overflow into M_DEVBUF past softc. Subsequent :2983 entries[num_entries-1]=entries[256] -> deterministic OOB write. :2987-2990 BCD loop + :2997 search loop OOB reads. CDIOREADTOCENTRYS at :2292 HAS the clamp cdcheckmedia lacks. Malicious SCSI/iSCSI CD-ROM READ_TOC ending_track=255. Automount triggers on media insertion. Heap grooming -> RIP control -> kernel RCE/panic. Fix: if(num_entries>nitems(softc->toc.entries)) goto bailout.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0987 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| cdcheckmedia_harness.c | trigger-source | faithful replication of cdcheckmedia TOC arithmetic | 3.5 KB | view raw |
| build.sh | build-script | cc -O2 -Wall [-DFIXED] | 171 B | view raw |
| run.sh | run-script | runs vulnerable + fixed | 142 B | view raw |
| run.log | run-log | vulnerable: 1256-byte overflow | 423 B | view raw |
| run_fixed.log | run-log | fixed: bailout | 165 B | view raw |
| fix.diff | suggested-fix | cap num_entries to nitems(softc->toc.entries) | 998 B | view raw |
| env.txt | environment | guest has only QEMU DVD-ROM (valid TOC) | 432 B | view raw |
| fix_build.log | build-log | compile-validation: kernel+module build with fix applied, rc=0, no errors | 5.6 MB | ↓ download |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
Fix verification
fixedcompile+harness validated
see evidence pack
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
—
Verdict
REPRODUCED (harness). cdcheckmedia unbounded TOC num_entries=257 -> 1256B heap overflow past softc->toc. No malicious CD target.
No comments yet.