⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1885

initsd computes size=0 for init_blocksize in [1,511]: OOB read / NULL-deref panic via bcmp

Summary

initsd L511 validates init_blocksize only ==0 and >MAX_REVIVE_BLOCKSIZE; lacks DEV_BSHIFT alignment check that revive_block L84-85 applies to revive_blocksize. init_blocksize 1..511 passes validation. L520 size=init_blocksize>>DEV_BSHIFT=0; <<DEV_BSHIFT=0. L523 Malloc(0) returns ZERO_LENGTH_PTR=(-8) kern_slaballoc.c:888-890. L555 *bp->b_data!=0 derefs addr -8 -> page fault panic. L556 bcmp(bp->b_data,&bp->b_data[1],bp->b_bcount-1) b_bcount int 0-1=-1 widened size_t SIZE_MAX OOB read. VINUM_SETSTATE start_object SD[idx].init_blocksize=data->blocksize vinumstate.c:884-885 non-zero test only. Root-only. Fix: mirror revive_block validation (init_blocksize&((1<<DEV_BSHIFT)-1)) reject non-aligned.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1885 · 4 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able fix for the cited bug 743 B view raw
VERDICT.md verdict source-confirmation analysis 712 B ↓ raw
build.sh build-script N/A (source-only) 61 B view raw
run.sh run-script N/A (source-only) 87 B view raw
VERDICT.md verdict source-confirmation analysis
↓ download raw

DF-1885 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: initsd L511 validates init_blocksize only ==0 and >MAX_REVIVE_BLOCKSIZE; lacks DEV_BSHIFT alignment check that revive_block L84-85 applies to revive_blocksize. init_blocksize 1..511 passes validation.

Citation: sys/dev/raid/vinum/vinumrevive.c:511-556

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: init_blocksize 1-511 yields size=0 -> Malloc(0)=ZERO_LENGTH_PTR deref (vinumrevive.c:511-556)

Verified recommended fix

Source-confirmed: init_blocksize 1-511 yields size=0 -> Malloc(0)=ZERO_LENGTH_PTR deref (vinumrevive.c:511-556)

Verdict

Source-confirmed: init_blocksize 1-511 yields size=0 -> Malloc(0)=ZERO_LENGTH_PTR deref (vinumrevive.c:511-556)