mpr_dispatch_event isset() OOB read when firmware supplies Event >= 128
Summary
mpr_dispatch_event() at mpr.c:2458-2460: event=le16toh(reply->Event) u16 (0-65535), then isset(eh->mask,event). eh->mask is uint8_t[16] (mprvar.h:266) so valid events 0-127. event>=128 -> isset reads eh->mask[event/8] OOB up to 8KB past mask. OOB byte controls whether callback function pointer is invoked. Malicious/buggy HBA. Fix: check event < sizeof(eh->mask)*NBBY before isset.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1230 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 889 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 778 B | view raw |
DF-1230 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
mpr_dispatch_event isset() OOB read when firmware supplies Event >= 128
Source Location
sys/dev/raid/mpr/mpr.c:2458-2460
Verdict
Source-confirmed: mpr_dispatch_event isset() OOB read when firmware supplies Event >= 12. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
mpr_dispatch_event() at mpr.c:2458-2460: event=le16toh(reply->Event) u16 (0-65535), then isset(eh->mask,event). eh->mask is uint8_t[16] (mprvar.h:266) so valid events 0-127. event>=128 -> isset reads eh->mask[event/8] OOB up to 8KB past mask. OOB byte controls whether callback function pointer is invoked. Malicious/buggy HBA. Fix: check event < sizeof(eh->mask)*NBBY before isset.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: mpr_dispatch_event uses firmware-reported Event in isset(eh->mask, event) without bounding event<128, OOB read. Added sizeof(mask)*NBBY bound. HW-gated.
Verified recommended fix
Source-confirmed: mpr_dispatch_event uses firmware-reported Event in isset(eh->mask, event) without bounding event<128, OOB read. Added sizeof(mask)*NBBY bound. HW-gated.
Verdict
Source-confirmed: mpr_dispatch_event uses firmware-reported Event in isset(eh->mask, event) without bounding event<128, OOB read. Added sizeof(mask)*NBBY bound. HW-gated.
No comments yet.