immio: off-by-one OOB heap read in OUTSTR path for odd blen
Summary
imm_do_scsi OUTSTR (r=0x88 wants more data) at immio.c:745-749: len = ((blen-*count)>=VP0_SECTOR_SIZE) ? VP0_SECTOR_SIZE : 2. Loop guard 739 if(*count>=blen) runs BEFORE len chosen. Odd blen: *count reaches blen-1 guard passes (blen-1<blen) but len=2 leaves 1 byte in-bounds. imm_outstr reads buffer[blen] 1 byte past CAM-allocated data_ptr (cam_periph_mapmem getpbuf_mem exact dxfer_len). Sibling vpoio.c:749-751 uses :1 fallback NOT affected. csio->resid wraps UINT32_MAX. 1 byte stale slab leaked to drive.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1762 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Use fallback len=1 instead of 2 for the EPP OUTSTR path. | 375 B | view raw |
| VERDICT.md | verdict | full analysis | 1.0 KB | ↓ raw |
DF-1762 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: leak:1 Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/disk/vpo/immio.c:745-749.
Mechanism
imm_do_scsi OUTSTR len=2 for odd blen: *count reaches blen-1, guard passes, but len=2 reads 1 byte past buffer[blen].
Fix
Use fallback len=1 instead of 2 for the EPP OUTSTR path.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
vpo module built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- v
- p
- o
- /
- i
- m
- m
- i
- o
- .
- c
- :
- 7
- 4
- 5
- -
- 7
- 4
- 9
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/disk/vpo/immio.c:745-749. Fix compiled clean.
PoC changes
authored fix.diff: change fallback len from 2 to 1
Verified recommended fix
Use fallback len=1 instead of 2 for EPP OUTSTR. Matches finding proposal.
Verdict
REPRODUCED (source-only). OUTSTR len=2 for odd blen reads 1 byte past buffer[blen].
No comments yet.