⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1933

Heap OOB write in dm_target_stripe_table via unchecked ksnprintf return value

Summary

dm_target_stripe_table L212-224 builds status string into 1024-byte DM_MAX_PARAMS_SIZE M_DM buffer using ret=ksnprintf(ptr,len,...); ptr+=ret; len-=ret without testing truncation. ksnprintf returns would-be written count (subr_prf.c:549 PCHAR increments retval even when snprintf_func discards). First truncation: len (size_t) underflows ~SIZE_MAX next ksnprintf unbounded size on dangling pointer writes attacker-influenced digit chars into adjacent slab. n=32 stripes offset=UINT64_MAX (20 digits) udev_name>=10 chars (e.g. 1024:12345 high-minor DM volume). Total 6+32*(22+L)>1024 when L>=10 overflow at i=31 ptr 6 past end. Same buggy pattern in dm_target_stripe_info L170-188 latent. Trigger: operator-group /dev/mapper/control 0640 root:operator (no priv_check anywhere in dm/ tree) reload striped table 32 stripes high-minor pdevs offset UINT64_MAX then status DM_STATUS_TABLE_FLAG. Impact: kernel heap corruption M_DM zone panic floor; grooming -> code-exec/priv-esc. Fix: if(ret<0||(size_t)ret>=len) break/goto out at all sites.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1933 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 659 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.6 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1933 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/disk/dm/striped/dm_target_striped.c:208-224. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

dm_target_striped (loaded as part of dm module). Source: dm_target_stripe_table at L212-224 builds status string into a 1024-byte DM_MAX_PARAMS_SIZE buffer using ret=ksnprintf(ptr,len,...); ptr+=ret; len-=ret without testing truncation. ksnprintf returns would-be written count; if truncated, ret>=len and subsequent len-=ret underflows, ptr+=ret advances past the buffer → heap OOB write.

Add if (ret < 0 || (size_t)ret >= len) goto trunc; before each ptr+=ret; len-=ret; pair.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1933/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Add if (ret < 0 || (size_t)ret >= len) goto trunc; before each ptr+=ret; len-=ret; pair. Full git-apply-able diff in findings/poc/DF-1933/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/disk/dm/striped/dm_target_striped.c:208-224. dm_target_striped (module, requires root). dm_target_stripe_table L212-224 builds status string into 1024-byte buffer using ret=ksnprintf(ptr,len,...); ptr+=ret; len-=ret without testing truncation. ksnprintf returns would-be written count; if truncated, ret>=len and subsequent len-=ret underflows, ptr+=ret advances past the buffer -> heap OOB write. Module gated.