Firmware-controlled desc_count/desc_len in oce_get_profile_config/oce_get_func_config walks OOB past DMA buffer
Summary
oce_get_profile_config at oce_mbox.c:2013-2023 and oce_get_func_config :2103-2113: desc_count from FW rsp.desc_count (u32 unbounded), loop nic_desc+=nic_desc->desc_len (FW u32 unbounded). resources[256*88=22528B]. desc_count>256 or desc_len>22528 -> walk past DMA buffer -> OOB heap read / page fault panic. Also desc_count=0xFFFFFFFF -> 4B iterations hang. Malicious/buggy HBA. Fix: cap desc_count<=MAX_RESC_DESC, validate desc_len>=sizeof(nic_resc_desc), check pointer<res_end.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1396 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Cap desc_count to MAX_RESC_DESC and validate desc_len minimum before pointer arithmetic. | 1.3 KB | view raw |
| VERDICT.md | verdict | Full source-trace analysis | 2.2 KB | ↓ raw |
| build.sh | build-script | Kernel build validation | 533 B | view raw |
| run.sh | run-script | PoC runner (not runnable on guest) | 606 B | view raw |
| fix_build.log | build-log | Full kernel build output (make nativekernel rc=0) | 5.6 MB | ↓ download |
| env.txt | environment | Guest environment | 277 B | view raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-1396 — Verification Verdict
Verdict: CONFIRMED-BY-SOURCE-TRACE (HW-gated)
Status: inconclusive (HW-gated / not reachable as unprivileged maxx) Impact: none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only) Confidence: certain (source-trace confirmed bug is real)
Mechanism
oce_get_profile_config (:2013-2023) and oce_get_func_config (:2103-2113): desc_count = HOST_32(fwcmd->params.rsp.desc_count) is a u32 from firmware response, unbounded. Loop walks nic_desc += nic_desc->desc_len (also FW-controlled u32) for desc_count iterations. resources[] is 22528 bytes (MAX_RESC_DESCRESC_DESC_SIZE=25688). desc_count>256 or desc_len>22528 walks past DMA buffer → OOB heap read / page fault. desc_count=0xFFFFFFFF causes ~4B iterations hang.
Source: sys/dev/netif/oce/oce_mbox.c:2013-2023, 2103-2113
Why it cannot be reproduced on this guest
HW-gated. oce (Emulex OneConnect 10Gb) is in GENERIC but requires actual Emulex NIC hardware. No oce NIC in QEMU guest. Module auto-loads only if HW present.
Phase 6: Escalation Assessment
This is a HW-gated NIC (Emulex oce) finding. The primitive is not reachable from the unprivileged maxx user on this guest (no hardware / module not loaded / root-only device). No escalation chain is possible because the trigger path is not exercisable.
For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest. For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx (uid 1001) has no operator group membership.
Fix
Cap desc_count <= MAX_RESC_DESC (256). Validate desc_len >= sizeof(struct oce_nic_resc_desc) before advancing pointer.
Fix description: Cap desc_count to MAX_RESC_DESC and validate desc_len minimum before pointer arithmetic.
The full git-apply-able diff is in fix.diff. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via make nativekernel rc=0).
Classification
- status: inconclusive
- reproduced: 0
- impact: none
- fix_status: not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- n
- e
- t
- i
- f
- /
- o
- c
- e
- /
- o
- c
- e
- _
- m
- b
- o
- x
- .
- c
- :
- 2
- 0
- 1
- 3
- -
- 2
- 0
- 2
- 3
- s
- y
- s
- /
- d
- e
- v
- /
- n
- e
- t
- i
- f
- /
- o
- c
- e
- /
- o
- c
- e
- _
- m
- b
- o
- x
- .
- c
- :
- 2
- 1
- 0
- 3
- -
- 2
- 1
- 1
- 3
Detail
Exploit chain
none (OOB heap read / info leak primitive — read-only. HW-gated: oce NIC not present in QEMU. Malicious/buggy HBA firmware is the threat model, not unprivileged user.)
Evidence (decisive lines)
Source trace: oce_mbox.c:2014 'desc_count = HOST_32(fwcmd->params.rsp.desc_count)' — no cap. :2015 'for (i = 0; i < desc_count; i++)' — unbounded. :2022 'nic_desc += nic_desc->desc_len' — FW-controlled stride.
PoC changes
Authored fix.diff: cap desc_count <= MAX_RESC_DESC (256, defined in oce_hw.h:2001); validate desc_len >= sizeof(struct oce_nic_resc_desc) before advancing pointer.
Verified recommended fix
Cap desc_count to MAX_RESC_DESC and validate desc_len minimum before pointer arithmetic in both oce_get_profile_config and oce_get_func_config. supersedes finding proposal. Full diff in findings/poc/DF-1396/fix.diff.
Verdict
CONFIRMED BY SOURCE TRACE. oce_get_profile_config (:2013-2023) and oce_get_func_config (:2103-2113): desc_count = HOST_32(fwcmd->params.rsp.desc_count) is u32 from firmware, unbounded. Loop walks nic_desc += nic_desc->desc_len (FW-controlled) for desc_count iterations. resources[] is 22528B. desc_count>256 or desc_len>22528 → OOB heap read past DMA buffer. Bug is real but HW-gated: oce (Emulex OneConnect 10Gb) requires actual NIC hardware absent from QEMU.
No comments yet.