⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1189

ciss_notify_logical: unbounded bus/target from controller notify event yields kernel OOB read/write

Summary

ciss_notify_logical at ciss.c:3931-3972: bus=cn->device.physical.bus (6-bit, 0-63) and target=cn->data.logical_status.logical_drive (u16, 0-65535) from controller DMA notify used to index sc->ciss_logical[bus][target] (sized [ciss_max_logical_bus][CISS_MAX_LOGICAL=15]) with NO bounds check. Writes ld->cl_status, ld->cl_update, and dereferences ld->cl_lstatus->status from OOB memory. Compromised/malicious CISS controller or PCI passthrough. Fix: validate bus<max_logical_bus and target<CISS_MAX_LOGICAL.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1189 · 11 files
FileTypeDescriptionSize
harness.c trigger-source replicates ciss_notify_logical indexing of ciss_logical[bus][target] with crafted controller values 4.3 KB view raw
README.md readme finding summary, why-harness, build/run/expected 1.2 KB ↓ raw
build.sh build-script cc -O2 -Wall -o harness harness.c 107 B view raw
run.sh run-script ./harness 60 B view raw
build.log build-log final build 13 B view raw
run.log run-log decisive run: bus=0/t=40 and bus=10 OOB confirmed 897 B view raw
fix.diff suggested-fix validate bus<=ciss_max_logical_bus and target<CISS_MAX_LOGICAL before indexing 553 B view raw
fix_build.log build-log single-fix GENERIC kernel build with this fix applied (shared, rc=0) 5.6 MB ↓ download
env.txt environment uname, cc version 286 B view raw
../fix_build_combined.log build-log Combined 41-finding kernel build (rc=0, -Werror clean) 5.6 MB ↓ download
../fix_build_summary.txt build-summary Summary of the combined 41-finding kernel build 826 B view raw
README.md readme finding summary, why-harness, build/run/expected
↓ download raw

DF-1189 — ciss_notify_logical: unbounded bus/target from controller notify event

Finding

ciss_notify_logical() (ciss.c:3923-3972) takes bus = cn->device.physical.bus and target = cn->data.logical_status.logical_drive directly from a controller DMA'd notify event and uses them as indices into sc->ciss_logical[bus][target] (:3933) with no bounds check. The allocation is [ciss_max_logical_bus][CISS_MAX_LOGICAL=15] (cissvar.h:49,230; populated at ciss.c:1373-1378). logical_drive is a u16 (0-65535, cissreg.h:331) and bus is a multi-bit field, so both can be far out of range. The function then writes ld->cl_status, ld->cl_update (:3951,3959,3971-3972) and dereferences ld->cl_lstatus->status (:3952-3953) — a kernel OOB write + an OOB-pointer dereference.

Why harness

ciss IS in X86_64_GENERIC but only attaches to HP/Compaq Smart Array controllers (PCI vendor 0x0e11); none on the QEMU guest. Harness replays the indexing with crafted controller-supplied bus/target against the real allocation geometry.

Build & run

./build.sh && ./run.sh

Expected

Harness computes the OOB offset for out-of-range bus/target and confirms the write/deref lands outside the allocated ciss_logical table.

Fix verification

not_testable

compile+harness validated

see evidence pack
↓ fix.diffn/a

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

—

Verdict

REPRODUCED (harness). ciss_notify_logical bus/target from controller DMA no bounds check -> OOB write + type confusion. ciss in GENERIC. No HP Smart Array.