ipmi_kcs_probe_align has unbounded polling loops (boot-time DoS)
Summary
ipmi_kcs_probe_align L527/536/566/573/586/594 while(status&KCS_STATUS_IBF){DELAY(100);status=INB(KCS_CTL_STS);} and while(!(status&KCS_STATUS_OBF)) loops lack the ticks-start<MAX_TIMEOUT guard that kcs_wait_for_ibf/obf L60/66/83/89 use. Invoked from PCI/ISA attach during autoconf config_intrhook. Malicious PCIe IPMI card or supply-chain BMC firmware compromise or buggy BMC that never clears IBF/never asserts OBF -> boot never completes kernel wedged at device-probe phase. Fix: route all flag polling through kcs_wait_for_ibf/obf or add ticks-start<MAX_TIMEOUT guard inline.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1866 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 511 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 708 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1866 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: ipmi_kcs_probe_align L527/536/566/573/586/594 while(status&KCS_STATUS_IBF){DELAY(100);status=INB(KCS_CTL_STS);} and while(!(status&KCS_STATUS_OBF)) loops lack the ticks-start<MAX_TIMEOUT guard that kc
Citation: sys/dev/misc/ipmi/ipmi_kcs.c:527-595
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: unbounded IBF/OBF polling loops in probe_align (ipmi_kcs.c:527-595)
Verified recommended fix
Source-confirmed: unbounded IBF/OBF polling loops in probe_align (ipmi_kcs.c:527-595)
Verdict
Source-confirmed: unbounded IBF/OBF polling loops in probe_align (ipmi_kcs.c:527-595)
No comments yet.