DVDIOCREADSTRUCTURE BCA/MANUFACT heap overflow via device-controlled length field
Summary
acd_read_structure at atapi-cd.c:1582-1589: BCA bcopy(d->data,s->data,ntohs(d->length)). d allocated 192B (188B data). s->data[2048]. d->length from device DMA (u16, 0-65535). length>188 -> OOB read past d into heap. length>2048 -> OOB write past s->data into ioctl scratch. MANUFACT same. Malicious/buggy ATAPI device. Fix: clamp length to min(source_data_bytes, sizeof(s->data)).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1435 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 904 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 525 B | view raw |
DF-1435 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
DVDIOCREADSTRUCTURE BCA/MANUFACT heap overflow via device-controlled length field
Source Location
sys/dev/disk/nata/atapi-cd.c:1582-1589
Verdict
Source-confirmed: DVDIOCREADSTRUCTURE BCA/MANUFACT heap overflow via device-controlled l. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
acd_read_structure at atapi-cd.c:1582-1589: BCA bcopy(d->data,s->data,ntohs(d->length)). d allocated 192B (188B data). s->data[2048]. d->length from device DMA (u16, 0-65535). length>188 -> OOB read past d into heap. length>2048 -> OOB write past s->data into ioctl scratch. MANUFACT same. Malicious/buggy ATAPI device. Fix: clamp length to min(source_data_bytes, sizeof(s->data)).
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: atapi-cd DVDIOCREADSTRUCTURE BCA/MANUFACT bcopy uses device-controlled s->length=ntohs(d->length) without bound, heap overflow. Added imin(sizeof(s->data)) bound. HW-gated.
Verified recommended fix
Source-confirmed: atapi-cd DVDIOCREADSTRUCTURE BCA/MANUFACT bcopy uses device-controlled s->length=ntohs(d->length) without bound, heap overflow. Added imin(sizeof(s->data)) bound. HW-gated.
Verdict
Source-confirmed: atapi-cd DVDIOCREADSTRUCTURE BCA/MANUFACT bcopy uses device-controlled s->length=ntohs(d->length) without bound, heap overflow. Added imin(sizeof(s->data)) bound. HW-gated.
No comments yet.