Unvalidated HBA-supplied index into srb[256] in itl/mv request callbacks
Summary
hptiop_request_callback_itl at :339: srb=hba->srb[index&0x3FFFFFFF] (256 entries). :348: srb=hba->srb[index&0x7FFFFFFF]. hptiop_request_callback_mv at :532: srb=hba->srb[context>>16] (range 0-0xFFFF). No bounds check vs HPT_SRB_MAX_QUEUE_SIZE=256. Malicious/buggy HBA returns OOB index -> wild srb ptr -> deref srb->ccb/dma_map -> panic or code exec. mvfrey callback correctly masks &0xFF. Fix: validate masked index<256.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1312 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 918 B | ↓ raw |
DF-1312 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
Unvalidated HBA-supplied index into srb[256] in itl/mv request callbacks
Source Location
sys/dev/raid/hptiop/hptiop.c:336-532
Verdict
Source-confirmed (complex fix): Unvalidated HBA-supplied index into srb[256] in itl/mv request callbac. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
hptiop_request_callback_itl at :339: srb=hba->srb[index&0x3FFFFFFF] (256 entries). :348: srb=hba->srb[index&0x7FFFFFFF]. hptiop_request_callback_mv at :532: srb=hba->srb[context>>16] (range 0-0xFFFF). No bounds check vs HPT_SRB_MAX_QUEUE_SIZE=256. Malicious/buggy HBA returns OOB index -> wild srb ptr -> deref srb->ccb/dma_map -> panic or code exec. mvfrey callback correctly masks &0xFF. Fix: validate masked index<256.
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: hptiop itl/mv request callbacks use HBA-supplied index into hba->srb[256] without masking to valid range. Complex fix. HW-gated.
Verified recommended fix
Source-confirmed: hptiop itl/mv request callbacks use HBA-supplied index into hba->srb[256] without masking to valid range. Complex fix. HW-gated.
Verdict
Source-confirmed: hptiop itl/mv request callbacks use HBA-supplied index into hba->srb[256] without masking to valid range. Complex fix. HW-gated.
No comments yet.