Off-by-up-to-7-bytes OOB read of ADMA2 descriptor table in sdhci_adma_irq error-path logger
Summary
sdhci_adma_irq at sdhci.c:1735-1742: addr < busaddr + SDHCI_ADMA2_DESCBUF_SIZE(4096) permits addr=4095. desc=addr, sizeof(desc)=8. desc->attribute(0-1)/length(2-3)/address(4-7) read 1-7 bytes past descriptor DMA allocation. Leaked bytes emitted via slot_printf to dmesg (world-readable). Trigger: ADMA2 error interrupt from malicious SD card or DMA glitch. Fix: addr+sizeof(*desc) <= busaddr+DESCBUF_SIZE.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1436 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 941 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 469 B | view raw |
DF-1436 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: speculative
Finding
Off-by-up-to-7-bytes OOB read of ADMA2 descriptor table in sdhci_adma_irq error-path logger
Source Location
sys/dev/disk/sdhci/sdhci.c:1735-1742
Verdict
Source-confirmed: Off-by-up-to-7-bytes OOB read of ADMA2 descriptor table in sdhci_adma_. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
sdhci_adma_irq at sdhci.c:1735-1742: addr < busaddr + SDHCI_ADMA2_DESCBUF_SIZE(4096) permits addr=4095. desc=addr, sizeof(desc)=8. desc->attribute(0-1)/length(2-3)/address(4-7) read 1-7 bytes past descriptor DMA allocation. Leaked bytes emitted via slot_printf to dmesg (world-readable). Trigger: ADMA2 error interrupt from malicious SD card or DMA glitch. Fix: addr+sizeof(*desc) <= busaddr+DESCBUF_SIZE.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: sdhci_adma_irq error-path logger reads ADMA2 descriptor at calculated offset without alignment check, up-to-7-bytes OOB read. Added bounds check before deref. HW-gated.
Verified recommended fix
Source-confirmed: sdhci_adma_irq error-path logger reads ADMA2 descriptor at calculated offset without alignment check, up-to-7-bytes OOB read. Added bounds check before deref. HW-gated.
Verdict
Source-confirmed: sdhci_adma_irq error-path logger reads ADMA2 descriptor at calculated offset without alignment check, up-to-7-bytes OOB read. Added bounds check before deref. HW-gated.
No comments yet.