⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1940

Divide-by-zero in ata_intel_31244_tf_write via crafted IDENTIFY CHS geometry (heads=0 or sectors=0)

Summary

ata_intel_31244_tf_write L471-478 when ATA_D_USE_CHS set: lba%sectors / (sectors*heads) / sectors without checking heads/sectors non-zero. heads/sectors from atadev->param.current_heads/current_sectors (when atavalid&ATA_FLAG_54_58) or param.heads/sectors L463-470 populated unfiltered from device IDENTIFY DEVICE response. ATA_D_USE_CHS set in ad_get_geometry ata-disk.c:485 when !ad_version(version_major)||!lbasize trivially true for malicious IDENTIFY (version_major=0/0xffff lba_size=0). ata-disk.c:469-470 guards current_heads/current_sectors before adp->heads/sectors but guard not propagated to tf_write. Trigger: malicious USB-to-SATA bridge/SATA DOM/compromised SSD returns IDENTIFY with word80=0 words60-61=0 word53 bit0 set words55/56=0. Intel 31244 DPA mode tf_write override L422. First I/O -> divide error -> kernel panic. Same pattern ata-lowlevel.c:783-790 ata-serverworks.c. Fix: if(heads==0||sectors==0)return EINVAL.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1940 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 478 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.5 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1940 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/disk/nata/chipsets/ata-intel.c:471-478. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

nata IS in GENERIC. Source: ata_intel_31244_tf_write at L471-478 (when ATA_D_USE_CHS set): lba%sectors, lba/(sectorsheads), sectorsheads — no zero check on heads/sectors. heads/sectors from atadev->param.current_heads/current_sectors (when atavalid&ATA_FLAG_54_58) or param.heads/sectors. A crafted IDENTIFY with heads=0 or sectors=0 divides by zero.

Add if (heads == 0 || sectors == 0) return; before the LBA math.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1940/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Add if (heads == 0 || sectors == 0) return; before the LBA math. Full git-apply-able diff in findings/poc/DF-1940/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/disk/nata/chipsets/ata-intel.c:471-478. nata IS in GENERIC. ata_intel_31244_tf_write L471-478 (when ATA_D_USE_CHS set): lba%sectors / (sectors*heads) / sectors without checking heads/sectors non-zero. heads/sectors from atadev->param.current_heads/current_sectors. Crafted IDENTIFY with heads=0 or sectors=0 -> divide by zero panic. HW gated (no Intel 31244 on guest).