Unbounded KCS reply-collection loop hangs kthread on hostile/buggy BMC
Summary
kcs_polled_request L411 for(;;) loop only terminates when BMC transitions KCS to IDLE (state==2 break L418-419). No upper bound on iterations or elapsed time. kcs_read_byte L262-297 returns 1 (continue) as long as KCS_STATUS_STATE==KCS_STATUS_STATE_READ; BMC controls that state. Each sub-wait (kcs_wait_for_ibf/obf) individually bounded MAX_TIMEOUT(6s) but outer loop not. Hostile/compromised/buggy BMC keeps READ state forever -> kcs_loop kthread wedged indefinitely blocks all IPMI requests (watchdog keep-alive sensor reads user ioctls) and prevents module unload (ipmi_detach lksleep ipmi.c:895 waits forever). BMC trust boundary. Fix: cap outer loop with ticks-start>=MAX_TIMEOUT.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1865 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 556 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 708 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1865 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: kcs_polled_request L411 for(;;) loop only terminates when BMC transitions KCS to IDLE (state==2 break L418-419). No upper bound on iterations or elapsed time. kcs_read_byte L262-297 returns 1 (continu
Citation: sys/dev/misc/ipmi/ipmi_kcs.c:410-432
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: unbounded for(;;) in kcs_polled_request hangs on hostile BMC (ipmi_kcs.c:410-432)
Verified recommended fix
Source-confirmed: unbounded for(;;) in kcs_polled_request hangs on hostile BMC (ipmi_kcs.c:410-432)
Verdict
Source-confirmed: unbounded for(;;) in kcs_polled_request hangs on hostile BMC (ipmi_kcs.c:410-432)
No comments yet.