immio: missing clen bound allows OOB read of csio struct in CDB-send loop
Summary
CDB-send loop immio.c:702 for(k=0;k<clen;k+=2) bounded only by clen. csio->cdb_io.cdb_bytes fixed u8[16] (CAM_MAX_CDBLEN). csio->cdb_len u8 0-255 CAM passthrough does NOT validate. vpo_intr passes clen=csio->cdb_len unchanged. xpt_merge_ccb bcopies user CCB no cdb_len check; passsendccb no validation. clen>16: loop reads adjacent csio fields (msg_ptr kernel pointer offset 16, msg_len, tag_action, tag_id, init_id) ships via imm_outstr to drive. clen=255 reads 240 bytes past cdb_bytes[15]. Malicious peripheral stores/replays -> KASLR bypass kernel pointer leak. Fix: clamp clen>CAM_MAX_CDBLEN at entry.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1763 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Clamp clen to 16 (CAM_MAX_CDBLEN) at entry. | 332 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1763 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: leak:240 Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/disk/vpo/immio.c:702.
Mechanism
CDB-send loop bounded by clen from csio->cdb_len (u8 0-255) without validation against CAM_MAX_CDBLEN=16; clen>16 reads adjacent csio fields and ships to drive via imm_outstr.
Fix
Clamp clen to 16 (CAM_MAX_CDBLEN) at entry.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
vpo module built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- v
- p
- o
- /
- i
- m
- m
- i
- o
- .
- c
- :
- 7
- 0
- 2
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/disk/vpo/immio.c:702. Fix compiled clean.
PoC changes
authored fix.diff: clamp clen to 16 (CAM_MAX_CDBLEN)
Verified recommended fix
Clamp clen to 16 at entry. Matches finding proposal.
Verdict
REPRODUCED (source-only). CDB-send loop bounded by csio->cdb_len (u8 0-255) without clamp to 16; reads adjacent csio fields shipped to drive.
No comments yet.