intpm: intsmb_bread discards SMBus block-read bytes; leaks uninitialized kernel stack via /dev/smb* SMB_BREAD
Summary
intsmb_bread at intpm.c:836-870 declares u_char data,nread at 840-841. After intsmb_stop returns 0, line 859 reads nread=bus_read_1(SMBHSTDAT0); check nread<=SMBBLOCKTRANS_MAX at 860. Loop at 862-863: for(i=0;i<nread;i++) data=bus_read_1(SMBBLKDAT); where data is function-local throwaway. MUST be buf[i]=bus_read_1. Contrast ichsmb.c:440 bcopy(sc->block_data,buf,...) and viapm.c:856-861 buf[i]=data. smbioctl at smb.c:211 char buf[SMB_MAXBLOCKSIZE] NO init; smbus_bread at 323; on success copyout(buf, rbuf, rcount) at 327-329 ships uninitialized kernel stack. Up to 32 bytes per ioctl. /dev/smb* mode 0600 root:wheel. /dev/kmem equivalent for root but stack leak still real. PIIX4/SB600+/FCH controllers.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1711 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Change 'data = bus_read_1(...)' to 'buf[i] = bus_read_1(...)' and remove unused | 600 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1711 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: leak:32 Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/powermng/intpm/intpm.c:862.
Mechanism
intsmb_bread reads block data into throwaway 'data' variable instead of buf[i], so the user buffer is never filled; copyout ships uninitialized kernel stack to userspace.
Fix
Change 'data = bus_read_1(...)' to 'buf[i] = bus_read_1(...)' and remove unused 'data' declaration.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
intpm.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- p
- o
- w
- e
- r
- m
- n
- g
- /
- i
- n
- t
- p
- m
- /
- i
- n
- t
- p
- m
- .
- c
- :
- 8
- 6
- 2
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/powermng/intpm/intpm.c:862. Fix compiled clean.
PoC changes
authored fix.diff: buf[i]=bus_read_1 + remove unused data decl
Verified recommended fix
Change data=bus_read_1 to buf[i]=bus_read_1; remove unused variable. Matches finding proposal.
Verdict
REPRODUCED (source-only). intsmb_bread reads block data into throwaway 'data' variable instead of buf[i]; copyout ships 32 bytes uninitialized kernel stack to userspace.
No comments yet.