Unbounded bcopy of user-controlled csio->cdb_len into 32-byte CDB32 frame (DF-1356/1547 class)
Summary
mrsas_cam.c:489-492 bcopy(cdb_ptr/cdb_bytes, CDB32, csio->cdb_len). CDB32 is u8[32] (mrsas.h:301) at offset 0x40 in 256-byte io_request frame. csio->cdb_len is u8 max 255. cdb_len>32 overwrites RaidContext(0x60)+SGL(0x80) -> DMA to attacker-influenced addresses. Today in-tree periphs cap at IOCDBLEN=16 (scsi_sg.c:507). Defense-in-depth missing: sibling mpr_sas.c:2105 has KASSERT, amr DF-1356. Fix: reject cdb_len > sizeof(CDB32).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1621 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 691 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 1.0 KB | ↓ raw |
| build.sh | build-script | N/A (source-only) | 65 B | view raw |
| run.sh | run-script | N/A (source-only) | 89 B | view raw |
DF-1621 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: mrsas_cam.c:489-492 bcopy(cdb_ptr/cdb_bytes, CDB32, csio->cdb_len). CDB32 is u8[32] (mrsas.h:301) at offset 0x40 in 256-byte io_request frame. csio->cdb_len is u8 max 255. cdb_len>32 overwrites RaidCo
Citation: sys/dev/raid/mrsas/mrsas_cam.c:489-492
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: unclamped csio->cdb_len bcopy into CDB32[32] (mrsas_cam.c:489-492)
Verified recommended fix
Source-confirmed: unclamped csio->cdb_len bcopy into CDB32[32] (mrsas_cam.c:489-492)
Verdict
Source-confirmed: unclamped csio->cdb_len bcopy into CDB32[32] (mrsas_cam.c:489-492)
No comments yet.