⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1882

Stack buffer overflow/underflow in ad_describe via non-NUL-terminated IDENTIFY model string

Summary

ad_describe L511-512 calls index(atadev->param.model,...) but param.model nata.h:68 is fixed u_int8_t[40] NOT guaranteed NUL-terminated. btrim/bpack ata-all.c only write NUL when compacted string <40 bytes; 40 distinct printable non-space/non-dash bytes leaves field unterminated. index() libkern/index.c:45 scans past model[39] into adjacent struct fields sectors_intr/usedmovsd/capabilities1 all attacker-controlled IDENTIFY words. L513 len=(marker-model) exceeds 40. L518 strncpy(product,model+len,40-len) with len>40 int 40-len negative -> size_t ~2^64 strncpy copies until NUL in source smashing 64-byte product stack buffer. L519 vendor[40-len]=0 with len>40 negative array index stack underflow. L516 vendor[len++]=0 overflows vendor[64] when len>=64. Malicious SATA/IDE peripheral/emulated controller/USB-ATA bridge. Trigger: device attach boot/hot-plug. Kernel stack corruption attacker-controlled bytes+offsets -> ring-0 code execution or panic DoS. Default config nata. Fix: local NUL-terminated copy modelbuf[41] before index() bound len to [0,40].

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1882 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 916 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.5 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1882 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/disk/nata/ata-disk.c:508-519. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

nata IS in GENERIC. Source: ad_describe at L511 calls index(atadev->param.model, ' '). param.model is u_int8_t[40] NOT guaranteed NUL-terminated by IDENTIFY. btrim/bpack only write NUL when compacted <40 bytes; 40 distinct printable bytes leaves no terminator → index() reads past the array.

Replace index() with an explicit 40-byte bounded scan for ' ' or '-'.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1882/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Replace index() with an explicit 40-byte bounded scan for ' ' or '-'. Full git-apply-able diff in findings/poc/DF-1882/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/disk/nata/ata-disk.c:508-519. nata IS in GENERIC. ad_describe L511 calls index(atadev->param.model, ' '). param.model is u_int8_t[40] NOT guaranteed NUL-terminated by IDENTIFY. btrim/bpack only write NUL when compacted <40 bytes; 40 distinct printable bytes leaves no terminator -> index() reads past the array (info leak / OOB read). HW gated (no ATA disk on guest).