Unchecked chip-controlled EventDataLength passed to hexdump reads past reply frame
Summary
mps_log_evt_handler at mps.c:1269: hexdump(event->EventData,event->EventDataLength,NULL,0). EventDataLength U16 from DMA reply. No bound vs reply frame size (~96-128 bytes). Length=0xFFFF -> reads 65KB past frame. Kernel heap info leak to console or panic. Sibling of DF-1281 (mpt EventDataLength). Malicious/buggy HBA. Fix: clamp length to ReplyFrameSize*4-offsetof(EventData).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1370 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 896 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 525 B | view raw |
DF-1370 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
Unchecked chip-controlled EventDataLength passed to hexdump reads past reply frame
Source Location
sys/dev/raid/mps/mps.c:1269-1267
Verdict
Source-confirmed: Unchecked chip-controlled EventDataLength passed to hexdump reads past. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
mps_log_evt_handler at mps.c:1269: hexdump(event->EventData,event->EventDataLength,NULL,0). EventDataLength U16 from DMA reply. No bound vs reply frame size (~96-128 bytes). Length=0xFFFF -> reads 65KB past frame. Kernel heap info leak to console or panic. Sibling of DF-1281 (mpt EventDataLength). Malicious/buggy HBA. Fix: clamp length to ReplyFrameSize*4-offsetof(EventData).
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: mps hexdump uses chip-controlled EventDataLength unbounded, reads past reply frame leaking kernel memory to console. Added sizeof(EventData) bound. HW-gated.
Verified recommended fix
Source-confirmed: mps hexdump uses chip-controlled EventDataLength unbounded, reads past reply frame leaking kernel memory to console. Added sizeof(EventData) bound. HW-gated.
Verdict
Source-confirmed: mps hexdump uses chip-controlled EventDataLength unbounded, reads past reply frame leaking kernel memory to console. Added sizeof(EventData) bound. HW-gated.
No comments yet.