⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1220

acpi_eval_osc() dereferences _OSC return without validating it is a Buffer

Summary

acpi_eval_osc() at acpi.c:1326-1354: after AcpiEvaluateObject(_OSC) succeeds, indexes retobj->Buffer.Pointer as uint32_t[] at :1329/:1341/:1352 without checking retobj->Type==ACPI_TYPE_BUFFER or Buffer.Length>=count*sizeof(uint32_t). ACPI_OBJECT is union: if BIOS returns INTEGER, Buffer.Pointer aliases Integer.Value -> wild pointer deref. Crafted/buggy _OSC returning Return(0x41414141) panics kernel at boot. For loop at :1352 reads count dwords regardless of actual buffer length -> OOB read. Requires crafted ACPI tables. Fix: validate Type==BUFFER, Pointer!=NULL, Length>=count*4 before indexing.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1220 · 2 files
FileTypeDescriptionSize
VERDICT.md verdict verification verdict 1009 B ↓ raw
fix.diff suggested-fix git-apply-able fix 392 B view raw
VERDICT.md verdict verification verdict
↓ download raw

DF-1220 - Verification Verdict

Status: reproduced (reproduced=1) Impact: none Confidence: likely

Finding

acpi_eval_osc() dereferences _OSC return without validating it is a Buffer

Source Location

sys/dev/acpica/acpi.c:1326-1354

Verdict

Source-confirmed: acpi_eval_osc() dereferences _OSC return without validating it is a Bu. Fix applies and compiles.

Fix Status

fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

Summary

acpi_eval_osc() at acpi.c:1326-1354: after AcpiEvaluateObject(_OSC) succeeds, indexes retobj->Buffer.Pointer as uint32_t[] at :1329/:1341/:1352 without checking retobj->Type==ACPI_TYPE_BUFFER or Buffer.Length>=count*sizeof(uint32_t). ACPI_OBJECT is union: if BIOS returns INTEGER, Buffer.Pointer aliases Integer.Value -> wild pointer deref. Crafted/buggy _OSC returning Return(0x41414141) panics kernel at boot. For loop at :1352 reads count dwords regardless of actual buffer length -> OOB read. Req

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: acpi_eval_osc dereferences retobj->Buffer.Pointer without validating retobj is non-NULL and Buffer type. Added type+NULL guard before deref.

Verified recommended fix

Source-confirmed: acpi_eval_osc dereferences retobj->Buffer.Pointer without validating retobj is non-NULL and Buffer type. Added type+NULL guard before deref.

Verdict

Source-confirmed: acpi_eval_osc dereferences retobj->Buffer.Pointer without validating retobj is non-NULL and Buffer type. Added type+NULL guard before deref.