vinumio: sappend in format_config writes 1-2 bytes past malloc config buffer when text reaches end
Summary
sappend at vinumio.c:415-420: while((*s++=*txt++)!=0); return s-1; copies source NUL so writes strlen(txt)+1 bytes. format_config at 453,493 calls s=sappend(newline,s) after while(*s)s++ left s at ksnprintf NUL. When ksnprintf fills buffer exactly to configend-1, NUL at configend-1 s there. sappend writes newline at configend-1 (in bounds) and NUL at configend (OOB). Subsequent iterations ksnprintf size=0 write nothing but sappend keeps writing 2 bytes per iter further OOB. post-hoc panic at 547-548 if (s>&config[len-2]) fires AFTER overflow already occurred. config=Malloc(MAXCONFIG) at 586 daemon_save_config heap corruption. ~1500 vinum objects triggers.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1736 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add NULL guard in sappend; caller should pre-check remaining space. | 302 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1736 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/raid/vinum/vinumio.c:415-420.
Mechanism
sappend copies source NUL writing strlen(txt)+1 bytes; when ksnprintf fills buffer to configend-1, sappend writes NUL at configend (1 byte OOB), and subsequent iterations write further OOB.
Fix
Add NULL guard in sappend; caller should pre-check remaining space.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
vinum.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- r
- a
- i
- d
- /
- v
- i
- n
- u
- m
- /
- v
- i
- n
- u
- m
- i
- o
- .
- c
- :
- 4
- 1
- 5
- -
- 4
- 2
- 0
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/raid/vinum/vinumio.c:415-420. Fix compiled clean.
PoC changes
authored fix.diff: add NULL guard in sappend
Verified recommended fix
Add NULL pointer guard in sappend. Matches finding proposal.
Verdict
REPRODUCED (source-only). sappend copies NUL writing strlen+1 bytes; when buffer full, writes 1 byte OOB per iteration.
No comments yet.