snp: SNPGTTY writes 8-byte cdev_t into 4-byte dev_t user buffer - kernel pointer leak + 4-byte overrun
Summary
snpioctl SNPGTTY at 588 *((cdev_t*)ap->a_data)=snp->snp_target. cdev_t=struct cdev*=8 bytes x86-64; SNPGTTY=_IOR(T,89,dev_t) dev_t=__uint32_t=4 bytes (snoop.h:30 types.h:84). 8-byte kernel heap pointer into 4-byte user buffer: KASLR partial defeat + 4-byte overrun. snp_target stored without reference_dev 571 can be stale. Round-trip SNPSTTY(SNPGTTY()) broken. Fix: write dev2udev(snp->snp_target) as dev_t.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1803 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Write dev2unit(snp->snp_target) as dev_t instead of the raw cdev_t pointer. | 358 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1803 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: leak:4 Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/misc/snp/snp.c:588.
Mechanism
SNPGTTY writes ((cdev_t)ap->a_data)=snp->snp_target — 8-byte kernel pointer into 4-byte dev_t buffer (SNPGTTY=_IOR(T,89,dev_t)); KASLR partial defeat + 4-byte overrun.
Fix
Write dev2unit(snp->snp_target) as dev_t instead of the raw cdev_t pointer.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
snp.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- m
- i
- s
- c
- /
- s
- n
- p
- /
- s
- n
- p
- .
- c
- :
- 5
- 8
- 8
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/misc/snp/snp.c:588. Fix compiled clean.
PoC changes
authored fix.diff: write dev2unit(snp_target) as dev_t
Verified recommended fix
Write dev2unit instead of raw cdev_t pointer. Matches finding proposal.
Verdict
REPRODUCED (source-only). SNPGTTY writes 8-byte cdev_t pointer into 4-byte dev_t buffer; KASLR partial defeat + 4-byte overrun.
No comments yet.