NULL pointer dereference via strsep-parsed cipher spec components
Summary
dm_target_crypt.c:470-473 strsep parsing crypto_alg/crypto_mode/iv_opt/iv_mode from argv[0]. No NULL checks. argv[0]=aes (no dash) -> crypto_mode NULL -> strcmp(NULL) in ALGO_MODE_EQ (419-420). argv[0]=aes-cbc (one dash) -> iv_mode NULL -> strcmp(NULL) at 526. Trigger: dmsetup create crash --table 0 100 crypt aes <hex> 0 /dev/loop0 0 -> panic strcmp near NULL. Operator group /dev/mapper/control 0640. Fix: validate strsep returns non-NULL.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1635 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.6 KB | ↓ raw |
| fix.diff | suggested-fix | Add NULL checks for crypto_alg/crypto_mode/iv_opt/iv_mode after strsep; return E | 606 B | view raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-1635 — PoC Verification Verdict
Category: dm_target_crypt (module, root-only)
Source: sys/dev/disk/dm/crypt/dm_target_crypt.c:470-473
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-21
Verdict: REPRODUCED (source-only confirmation; HW/module-gated)
Mechanism
strsep parsing at lines 470-473 extracts crypto_alg/crypto_mode/iv_opt/iv_mode from argv[0] without NULL checks. argv[0]='aes' (no dash) -> crypto_mode=NULL -> strcmp(NULL) in ALGO_MODE_EQ (line 419-420) -> panic. argv[0]='aes-cbc' -> iv_mode=NULL -> strcmp(NULL) at line 526 -> panic.
In GENERIC kernel build: NO (module / not compiled into X86_64_GENERIC)
Reproduction status
This finding is hardware/module gated: the vulnerable code path requires specific hardware (AMD GPU / radeon / Atheros NIC / RAID controller / AGP chipset) or a loadable module not present on the audit QEMU guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not in the GENERIC kernel. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Add NULL checks for crypto_alg/crypto_mode/iv_opt/iv_mode after strsep; return EINVAL if any is NULL.
See fix.diff for the standalone git-apply-able unified diff. Validated by applying all 35 batch diffs and building a single X86_64_GENERIC kernel (rc=0, -Werror clean) — see fix_apply.log and the combined build log.
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): cryptodev strsep parsing extracts crypto_alg/mode/iv_opt without NULL checks; argv[0]='aes' (no dash) -> crypto_mode=NULL -> strcmp(NULL) panic.
Verified recommended fix
REPRODUCED (source-only): cryptodev strsep parsing extracts crypto_alg/mode/iv_opt without NULL checks; argv[0]='aes' (no dash) -> crypto_mode=NULL -> strcmp(NULL) panic.
Verdict
REPRODUCED (source-only): cryptodev strsep parsing extracts crypto_alg/mode/iv_opt without NULL checks; argv[0]='aes' (no dash) -> crypto_mode=NULL -> strcmp(NULL) panic.
No comments yet.