OOB read of sdtr_period_tbl[8] on non-Ultra controllers when sync_data upper nibble>=8
Summary
adv_sdtr_to_period_offset at advlib.c:1073: *period=sdtr_period_tbl[((sync_data>>4)&0xF)]. Non-Ultra table has 8 entries, mask 0xF permits 0-15. sdtr_period_tbl_size=8 available but unused. sync_data from EEPROM sdtr_data[]. Upper nibble>=8 -> reads 1-7B past array into adjacent sdtr_period_tbl_ultra. Wrong SDTR period negotiated. EEPROM-controlled. No user/remote path. Fix: clamp idx<sdtr_period_tbl_size.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1406 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 939 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 485 B | view raw |
DF-1406 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
OOB read of sdtr_period_tbl[8] on non-Ultra controllers when sync_data upper nibble>=8
Source Location
sys/dev/disk/advansys/advlib.c:1073-1073
Verdict
Source-confirmed: OOB read of sdtr_period_tbl[8] on non-Ultra controllers when sync_data. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
adv_sdtr_to_period_offset at advlib.c:1073: *period=sdtr_period_tbl[((sync_data>>4)&0xF)]. Non-Ultra table has 8 entries, mask 0xF permits 0-15. sdtr_period_tbl_size=8 available but unused. sync_data from EEPROM sdtr_data[]. Upper nibble>=8 -> reads 1-7B past array into adjacent sdtr_period_tbl_ultra. Wrong SDTR period negotiated. EEPROM-controlled. No user/remote path. Fix: clamp idx<sdtr_period_tbl_size.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: advlib sdtr_period_tbl[((sync_data>>4)&0xF)] index can be >=8 on non-Ultra controllers, OOB read of sdtr_period_tbl[8]. Added sdtr_period_tbl_size bound. HW-gated.
Verified recommended fix
Source-confirmed: advlib sdtr_period_tbl[((sync_data>>4)&0xF)] index can be >=8 on non-Ultra controllers, OOB read of sdtr_period_tbl[8]. Added sdtr_period_tbl_size bound. HW-gated.
Verdict
Source-confirmed: advlib sdtr_period_tbl[((sync_data>>4)&0xF)] index can be >=8 on non-Ultra controllers, OOB read of sdtr_period_tbl[8]. Added sdtr_period_tbl_size bound. HW-gated.
No comments yet.