Ioctl copyin precedes bounds check vs HBA-controlled max_request_size + itl 8B copyout of 4B field
Summary
hptiop_do_ioctl_mv/mvfrey at :1263/1359: copyin(lpInBuffer,req->buf,nInBufferSize) BEFORE size check at :1219/1301. Check compares nInBufferSize vs hba->max_request_size (HBA-reported) not actual ctlcfg DMA size (~1969B). Malicious HBA reports large request_size -> overflow of ctlcfg DMA block (mvfrey: corrupts inlist/outlist). itl lpBytesReturned copyout at :1195: sizeof(unsigned long)=8 from 4-byte bytes_returned field -> 4B info leak. Root only. Fix: move bounds check before copyin, use actual DMA size, fix itl copyout to sizeof(u_int32_t).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1313 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
DF-1313 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
Ioctl copyin precedes bounds check vs HBA-controlled max_request_size + itl 8B copyout of 4B field
Source Location
sys/dev/raid/hptiop/hptiop.c:1085-1377
Verdict
Source-confirmed (complex fix): Ioctl copyin precedes bounds check vs HBA-controlled max_request_size . No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
hptiop_do_ioctl_mv/mvfrey at :1263/1359: copyin(lpInBuffer,req->buf,nInBufferSize) BEFORE size check at :1219/1301. Check compares nInBufferSize vs hba->max_request_size (HBA-reported) not actual ctlcfg DMA size (~1969B). Malicious HBA reports large request_size -> overflow of ctlcfg DMA block (mvfrey: corrupts inlist/outlist). itl lpBytesReturned copyout at :1195: sizeof(unsigned long)=8 from 4-byte bytes_returned field -> 4B info leak. Root only. Fix: move bounds check before copyin, use actua
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: hptiop ioctl copyin of params precedes bounds check vs HBA-controlled max_request_size (TOCTOU); also 8B copyout of 4B field. Complex fix. HW-gated.
Verified recommended fix
Source-confirmed: hptiop ioctl copyin of params precedes bounds check vs HBA-controlled max_request_size (TOCTOU); also 8B copyout of 4B field. Complex fix. HW-gated.
Verdict
Source-confirmed: hptiop ioctl copyin of params precedes bounds check vs HBA-controlled max_request_size (TOCTOU); also 8B copyout of 4B field. Complex fix. HW-gated.
No comments yet.