Kernel pointer/function pointer leak via bcopy of full union ccb in CAMGETPASSTHRU
Summary
cam_periph_ioctl CAMGETPASSTHRU at cam_periph.c:888 cam_periph_getccb returns CCB with live kernel pointers (cbfcnp function pointer, path heap pointer, periph_priv saved_ccb_ptr, sim_priv, timeout_ch) from prior use. xpt_setup_ccb does NOT clear these fields. :923 bcopy(ccb,addr,sizeof(union ccb)) copies entire union including kernel pointers to userspace. Root-only (SYSCAP_RESTRICTEDROOT on periph open). KASLR bypass / kernel-text-base disclosure. Unlike scsi_pass.c passsendccb which clears cbfcnp+periph_priv. Fix: NULL cbfcnp/path, bzero periph_priv/sim_priv before bcopy.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1025 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 390 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/bus/cam/cam_periph.c:888: kernel/function pointer leak via bcopy of full union ccb in CAMGETPASSTHRU
Verified recommended fix
Source-confirmed at sys/bus/cam/cam_periph.c:888: kernel/function pointer leak via bcopy of full union ccb in CAMGETPASSTHRU
Verdict
Source-confirmed at sys/bus/cam/cam_periph.c:888: kernel/function pointer leak via bcopy of full union ccb in CAMGETPASSTHRU
No comments yet.