aac_cam: unbounded CDB bcopy overflows struct aac_srb.cdb[16] into sg_map
Summary
aac_cam_action at 443-449 srb->cdb_len=csio->cdb_len; bcopy(cdb,srb->cdb[0],srb->cdb_len). srb->cdb u8[16] (aacreg.h:1396); csio->cdb_len u8 max 255; CAM never bounds. pass(4) xpt_merge_ccb preserves; sg(4) bounds at 507. Overflow past srb->cdb into srb->sg_map.SgCount+SgEntry[0] but stays within 480-byte FIB data region no kernel OOB. Protocol-level corruption only. Defense-in-depth. Fix: srb->cdb_len=min(csio->cdb_len,sizeof(srb->cdb)).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1824 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.6 KB | ↓ raw |
| fix.diff | suggested-fix | Clamp: srb->cdb_len = min(csio->cdb_len, sizeof(srb->cdb)). | 530 B | view raw |
| ../fix_build_new.log | build-log | Batch kernel build with new fixes (rc=0, -Werror) | 5.6 MB | ↓ download |
DF-1824 — PoC Verification Verdict
Category: raid (IN GENERIC)
Source: sys/dev/raid/aac/aac_cam.c:443-449
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-25
Verdict: REPRODUCED (source-only confirmation; GENERIC-compiled, no HW)
Mechanism
aac_cam: bcopy(csio->cdb_io.cdb_ptr, &srb->cdb[0], srb->cdb_len) where srb->cdb is char[16] in struct aac_srb. csio->cdb_len can be up to 16 (MAX_CDBLEN) but driver doesn't clamp it; if upper layer passes 20 or more (SCSI-3), overflows cdb[] into adjacent sg_map/array field.
In GENERIC kernel build: YES (file compiled by X86_64_GENERIC)
Reproduction status
This finding is GENERIC-compiled but trigger requires specific runtime state: the vulnerable code path requires specific runtime state (specific device probe, RAID config, sysctl, or process context) not reproducible from the unprivileged audit guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Clamp: srb->cdb_len = min(csio->cdb_len, sizeof(srb->cdb)).
See fix.diff for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): aac_cam bcopy(csio->cdb_io.cdb_ptr,&srb->cdb[0],srb->cdb_len) where srb->cdb is char[16] in struct aac_srb; csio->cdb_len not clamped; upper layer passing >16 -> overflow cdb
Verified recommended fix
REPRODUCED (source-only): aac_cam bcopy(csio->cdb_io.cdb_ptr,&srb->cdb[0],srb->cdb_len) where srb->cdb is char[16] in struct aac_srb; csio->cdb_len not clamped; upper layer passing >16 -> overflow cdb[] into sg_map.
Verdict
REPRODUCED (source-only): aac_cam bcopy(csio->cdb_io.cdb_ptr,&srb->cdb[0],srb->cdb_len) where srb->cdb is char[16] in struct aac_srb; csio->cdb_len not clamped; upper layer passing >16 -> overflow cdb[] into sg_map.
No comments yet.