DF-1379
btexecuteccb SG-list copy has no nseg<=BT_NSEG bound (latent heap overflow)
Summary
btexecuteccb at bt.c:1252-1266: while(dm_segs<end_seg) sg->len/addr=... sg++. sg_list has BT_NSEG=32 slots. No check nseg<=32. Manual SCATTER_VALID path in btaction passes csio->sglist_cnt unbounded. Currently not reachable: bus_dma path caps nsegments=32, pass(4) single-buffer. Latent defense-in-depth. Fix: check nseg<=BT_NSEG.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1379 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 391 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/disk/buslogic/bt.c:836: SG-list copy has no nseg<=BT_NSEG bound (latent heap overflow)
Verified recommended fix
Source-confirmed at sys/dev/disk/buslogic/bt.c:836: SG-list copy has no nseg<=BT_NSEG bound (latent heap overflow)
Verdict
Source-confirmed at sys/dev/disk/buslogic/bt.c:836: SG-list copy has no nseg<=BT_NSEG bound (latent heap overflow)
No comments yet.