adwlib: adw_find_period reads one element past adw_syncrates[] on unrecognized mc_sdtr, leaking 1 byte of adjacent rodata
Summary
adw_find_period at adwlib.c:825-829 loops adw_syncrates[0..5] for matching mc_sdtr; if none matches falls through to return adw_syncrates[i].period with i==adw_num_syncrates==6 -> reads 1 element past 6-element const array. Compare adw_find_sdtr at 817 correctly returns ADW_MC_SDTR_ASYNC fallback. adwcam.c:673-674 passes raw 4-bit nibble from user_sdtr[] set from EEPROM at adwcam.c:942-958 with only mc_sdtr &= 0xFF no range check. Non-ULTRA chip (ASC38C0800/ASC38C1600) crafted EEPROM sdtr nibble 6-15 -> XPT_GET_TRAN_SETTINGS via camcontrol triggers. 64-bit reads 1 byte of adjacent const int adw_num_syncrates value 6 no useful info. Requires crafted EEPROM / malicious AdvanSys card.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1715 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add bounds check: if i>=adw_num_syncrates, return adw_syncrates[0].period. | 339 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1715 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: leak:4 Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/disk/advansys/adwlib.c:825-829.
Mechanism
adw_find_period loops adw_syncrates[0..5]; if no match falls through with i==6, reads adw_syncrates[6] one element past the 6-element array.
Fix
Add bounds check: if i>=adw_num_syncrates, return adw_syncrates[0].period.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0 (adwlib.c is optional config driver compiled by nativekernel).
Batch build rc=0, 0 errors.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- a
- d
- v
- a
- n
- s
- y
- s
- /
- a
- d
- w
- l
- i
- b
- .
- c
- :
- 8
- 2
- 5
- -
- 8
- 2
- 9
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/disk/advansys/adwlib.c:825-829. Fix compiled clean in batch build (optional adw driver).
PoC changes
authored fix.diff: bounds check i>=adw_num_syncrates return adw_syncrates[0].period
Verified recommended fix
Add bounds check before array access. Matches finding proposal.
Verdict
REPRODUCED (source-only). adw_find_period falls through with i==6 reading adw_syncrates[6] one past 6-element array. Requires crafted EEPROM.
No comments yet.