⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1378

Off-by-one NUL write past bt->model[5] in bt_fetch_adapter_info on every attach

Summary

bt_fetch_adapter_info at bt.c:420-425: for(i=0;i<sizeof(ascii_model)=5;i++) model[i]=ascii_model[i]; if space break. model[5] (btreg.h:638). No space in 5 bytes -> i=5 -> model[5]=\0 one past end. model is LAST field of bt_softc -> writes 1 byte past allocation. Fix: i<sizeof(model)-1, break on space or NUL.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1378 · 2 files
FileTypeDescriptionSize
VERDICT.md verdict verification verdict 827 B ↓ raw
fix.diff suggested-fix git-apply-able fix 438 B view raw
VERDICT.md verdict verification verdict
↓ download raw

DF-1378 - Verification Verdict

Status: reproduced (reproduced=1) Impact: none Confidence: certain

Finding

Off-by-one NUL write past bt->model[5] in bt_fetch_adapter_info on every attach

Source Location

sys/dev/disk/buslogic/bt.c:420-425

Verdict

Source-confirmed: Off-by-one NUL write past bt->model[5] in bt_fetch_adapter_info on eve. Fix applies and compiles.

Fix Status

fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

Summary

bt_fetch_adapter_info at bt.c:420-425: for(i=0;i i=5 -> model[5]=\0 one past end. model is LAST field of bt_softc -> writes 1 byte past allocation. Fix: i<sizeof(model)-1, break on space or NUL.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: bt_fetch_adapter_info loops to sizeof(model_data.ascii_model) but writes bt->model[5], off-by-one NUL write past array. Fixed to imin(sizeof,model). HW-gated.

Verified recommended fix

Source-confirmed: bt_fetch_adapter_info loops to sizeof(model_data.ascii_model) but writes bt->model[5], off-by-one NUL write past array. Fixed to imin(sizeof,model). HW-gated.

Verdict

Source-confirmed: bt_fetch_adapter_info loops to sizeof(model_data.ascii_model) but writes bt->model[5], off-by-one NUL write past array. Fixed to imin(sizeof,model). HW-gated.