DF-1328 — mpr_user_event_report kernel-heap info leak

Status: INCONCLUSIVE (real bug; needs LSI SAS3+ HBA absent from audit guest) Impact: info leak (kernel heap past recorded_events[40000], operator-group reachable) Driver: mpr (LSI MPT-Fusion 3 SAS) — in X86_64_GENERIC but no HBA on guest

Build & run

./build.sh        # cc -o poc poc.c -Wall
./run.sh          # ./poc   (as an operator-group user on an mpr-equipped host)

On the audit guest the PoC fails at open("/dev/mpr0") with ENOENT. See VERDICT.md for the full trace and fix.diff for the validated patch.

Files

• poc.c — PoC (MPTIOCTL_EVENT_REPORT, Size=256KiB ≥ 40000)
• VERDICT.md — full mechanism trace with path:line citations
• fix.diff — copyout exactly sizeof(recorded_events), not user size
• build.sh/run.sh, build.log/run.log, fix_build.log, env.txt, manifest.json

DF-1328 — mpr_user_event_report kernel-heap info leak

Verdict

INCONCLUSIVE (real bug, needs hardware absent from guest). Source trace confirms the vulnerability; it cannot be executed on this QEMU guest because /dev/mpr0 does not exist (no LSI SAS3+ HBA), so the PoC fails at open() with ENOENT. Fix validated to apply + compile in a full nativekernel build.

Mechanism

sys/dev/raid/mpr/mpr_user.c:2074  mpr_lock(sc);
sys/dev/raid/mpr/mpr_user.c:2075  size = data->Size;                         // uint32_t, user-controlled
sys/dev/raid/mpr/mpr_user.c:2076  if ((size >= sizeof(sc->recorded_events)) && (status == 0)) {
sys/dev/raid/mpr/mpr_user.c:2077      mpr_unlock(sc);
sys/dev/raid/mpr/mpr_user.c:2078      if (copyout((void *)sc->recorded_events,
sys/dev/raid/mpr/mpr_user.c:2079          PTRIN(data->PtrEvents), size) != 0)   // *** LEAK: len = user size ***
sys/dev/raid/mpr/mpr_user.c:2080          status = EFAULT;
sys/dev/raid/mpr/mpr_user.c:2081      mpr_lock(sc);

sizeof(sc->recorded_events) = MPR_EVENT_QUEUE_SIZE (200) × sizeof(mpr_event_entry_t) (= 4+4+4*MPR_MAX_EVENT_DATA_LENGTH = 4+4+4*48 = 200) = 40000 bytes (sys/dev/raid/mpr/mpr_ioctl.h:206, :207, :224-229; sys/dev/raid/mpr/mprvar.h:445).

The gate at 2076 is a lower bound, not an upper bound: it only requires size >= 40000. The copyout length is the user-supplied size, which can be up to 0xFFFFFFFF (4 GiB). Setting size to, say, 256 KiB reads 256 KiB out of sc->recorded_events — 40000 bytes of the array plus ~220 KiB of whatever follows it inside struct mpr_softc (DMA bus addresses, kernel pointers, locks, command rings) and into adjacent kernel heap. Deterministic kernel-heap information leak.

Reachability on this guest

Identical to DF-1327: mpr is compiled into GENERIC but no SAS HBA is present → no /dev/mpr0 → PoC fails at open():

poc: open /dev/mpr0: No such file or directory   (RUN_EXIT=1)

Privilege model is the same (device UID_ROOT/GID_OPERATOR 0640, mpr_open returns 0, mpr_ioctl does no priv_check): reachable by root or operator-group users on an mpr-equipped host.

Phase-4(d) again: real code path, unreachable on this guest due to absent hardware.

Exploit chain

None — read-only OOB info leak, no corruption primitive. Impact ceiling: deterministic disclosure of the mpr_softc tail (DMA addresses, kernel pointers) and adjacent heap, repeated to taste. KASLR-bypass / heap layout reconnaissance.

PoC changes

Folder was empty. Authored poc.c (opens /dev/mpr0, issues MPTIOCTL_EVENT_REPORT with Size = 256 KiB, dumps bytes 40000..40256 of the softc tail), build.sh, run.sh.

Fix

fix.diff makes the copyout length sizeof(sc->recorded_events) (the fixed array size) instead of the user-controlled size. The size >= gate remains the lower-bound "did the user give us a big enough buffer?" check; the actual bytes copied are now exactly the array. Applies cleanly and was built in the full nativekernel run (fix_build.log).

Fix validation

fix_status: not_testable — PoC cannot run (no /dev/mpr0). Fix validated by apply + compile + code-path inspection (copyout length is now the constant array size, independent of data->Size).