vinumioctl: VINUM_GETFREELIST signed fe allows negative free-list index -> 16-byte OOB heap read
Summary
VINUM_GETFREELIST path vinumioctl.c:76 int fe from user data[1] at 260. Bound check 264 fe >= DRIVE[index].freelist_entries. Negative fe fails check (e.g. -1 < freelist_entries) reaches bcopy(&DRIVE[index].freelist[fe], data, sizeof(drive_freelist)=16) at 267 - 16 bytes from BEFORE heap allocation. Large negative -> unmapped -> panic. RESTRICTEDROOT gate. Fix: unsigned or >= 0 guard.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1740 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Cast fe to unsigned to make negative values fail the bounds check. | 599 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1740 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/raid/vinum/vinumioctl.c:260-264,267.
Mechanism
VINUM_GETFREELIST uses signed int fe from user data; negative fe passes the >= freelist_entries check and bcopy reads before the heap allocation.
Fix
Cast fe to unsigned to make negative values fail the bounds check.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
vinum.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- r
- a
- i
- d
- /
- v
- i
- n
- u
- m
- /
- v
- i
- n
- u
- m
- i
- o
- c
- t
- l
- .
- c
- :
- 2
- 6
- 0
- s
- y
- s
- /
- d
- e
- v
- /
- r
- a
- i
- d
- /
- v
- i
- n
- u
- m
- /
- v
- i
- n
- u
- m
- i
- o
- c
- t
- l
- .
- c
- :
- 2
- 6
- 7
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/raid/vinum/vinumioctl.c:260,267. Fix compiled clean.
PoC changes
authored fix.diff: cast fe to unsigned
Verified recommended fix
Cast freelist index to unsigned. Matches finding proposal.
Verdict
REPRODUCED (source-only). Signed int fe from user data; negative passes bounds check and bcopy reads before heap allocation.
No comments yet.