draw_txtmouse reads/writes scp->scr past vtb_size on the bottom screen row (FIXME-acknowledged)
Summary
scvgarndr.c:340-351 reads sc_vtb_getc(pos+scp->xsize{,+1}) and 384-391 writes sc_vtb_putc(pos+scp->xsize{,+1}) with NO bounds check. pos itself clamped [0,xsize*ysize-1] by set_mouse_pos, but pos+xsize exceeds vtb_size when mouse on bottom row (ysize-1). FIXME at 384 acknowledges. sc_vtb_getc/putc deref vtb_buffer+at directly no bounds (scvtb.c:146-170). On stock VGA aperture 32KB > 132*60*2 so harmless (cosmetic glitch); on tight-aperture framebuffer faults past mapped MMIO -> panic. Trigger: /dev/sysmouse mode 0666 -> move mouse to bottom row. Fix: imin(pos+xsize, scr_size-1) and if(pos+xsize<scr_size) guards.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1602 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 580 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 712 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1602 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: scvgarndr.c:340-351 reads sc_vtb_getc(pos+scp->xsize{,+1}) and 384-391 writes sc_vtb_putc(pos+scp->xsize{,+1}) with NO bounds check. pos itself clamped [0,xsize*ysize-1] by set_mouse_pos, but pos+xsiz
Citation: sys/dev/misc/syscons/scvgarndr.c:340-391
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: sc_vtb_getc/putc at pos+xsize past vtb_size on bottom row (scvgarndr.c:340-391)
Verified recommended fix
Source-confirmed: sc_vtb_getc/putc at pos+xsize past vtb_size on bottom row (scvgarndr.c:340-391)
Verdict
Source-confirmed: sc_vtb_getc/putc at pos+xsize past vtb_size on bottom row (scvgarndr.c:340-391)
No comments yet.