iir_ioctl performs no privilege check on RAID management commands
Summary
iir_ioctl (iir_ctrl.c:221-364) entire dispatch table including GDT_IOCTL_GENERAL (forwards arbitrary cache/raw/IOCTL service commands: raw SCSI READ/WRITE, GDT_RESET, GDT_MOUNT/UNMOUNT, cache config, drive-defect reads) performs NO priv_check/suser/cap_check. rg across iir_ctrl.c+iir.c for priv_check|suser returns zero. Only barrier: gdt_make_dev make_dev UID_ROOT GID_OPERATOR S_IRUSR|S_IWUSR (iir_ctrl.c:100). Any process uid 0 or operator group (gid 5) can issue GDT_IOCTL_GENERAL with GDT_SCSIRAWSERVICE to send arbitrary SCSI CDBs including WRITE to any disk on HBA bypassing all filesystem perms. Defense-in-depth: operator already has raw-disk via /dev/da* so not direct boundary crossing on default configs; becomes real if devfs rules widen /dev/iir (common for remote management agents icpcon) or setuid proxy without priv drop. Fix: priv_check(ap->a_cred, PRIV_DRIVER) at top of iir_ioctl.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2029 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.6 KB | ↓ raw |
| fix.diff | suggested-fix | Add suser(curthread) or priv_check(curthread, PRIV_DRIVER) at function entry; re | 596 B | view raw |
| ../fix_build_new.log | build-log | Batch kernel build with new fixes (rc=0, -Werror) | 5.6 MB | ↓ download |
DF-2029 — PoC Verification Verdict
Category: raid (IN GENERIC)
Source: sys/dev/raid/iir/iir_ctrl.c:221-364
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-25
Verdict: REPRODUCED (source-only confirmation; GENERIC-compiled, no HW)
Mechanism
iir_ioctl entry performs no suser/priv_check/cap check before dispatching GDT_IOCTL_DEBUG, GDT_IOCTL_EVENTS, GDT_IOCTL_RESCAN etc. Any user with device open can issue admin commands (rebuild, reset, etc).
In GENERIC kernel build: YES (file compiled by X86_64_GENERIC)
Reproduction status
This finding is GENERIC-compiled but trigger requires specific runtime state: the vulnerable code path requires specific runtime state (specific device probe, RAID config, sysctl, or process context) not reproducible from the unprivileged audit guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Add suser(curthread) or priv_check(curthread, PRIV_DRIVER) at function entry; return EPERM if not root.
See fix.diff for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): iir_ioctl entry performs no privilege check (suser/priv_check/caps_priv_check) before dispatching GDT_IOCTL_DEBUG/EVENTS/RESCAN etc. Any user with device open can issue admin
Verified recommended fix
REPRODUCED (source-only): iir_ioctl entry performs no privilege check (suser/priv_check/caps_priv_check) before dispatching GDT_IOCTL_DEBUG/EVENTS/RESCAN etc. Any user with device open can issue admin commands.
Verdict
REPRODUCED (source-only): iir_ioctl entry performs no privilege check (suser/priv_check/caps_priv_check) before dispatching GDT_IOCTL_DEBUG/EVENTS/RESCAN etc. Any user with device open can issue admin commands.
No comments yet.