Kernel panic on attacker-controlled SD CSD structure version
Summary
mmc_decode_csd_sd() extracts 2-bit CSD structure version from raw card data and unconditionally panics kernel when value is anything other than 0 or 1. A malicious/corrupted SD card (including one emulated by USB card reader) returning csd_structure==2 or ==3 in CMD9 CSD response takes down whole system. Card fully controls those bits. mmc_discover_cards reads CSD straight from card via mmc_send_csd into ivar->raw_csd then calls mmc_decode_csd_sd with no validation. Dispatch covers only v==0 and v==1; else panic(unknown SD CSD version). Reachable from boot resume and hotplug rescan. Attacker presents crafted SD card via USB SD-card reader emulated SD device card with corrupted firmware or MITM on SD bus.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2317 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | analysis: code bug confirmed, gate confirmed, fix authored | 1.4 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able defense-in-depth fix (verified --check clean) | 658 B | view raw |
| env.txt | environment | guest gate-proof: usbconfig/pciconf/ifconfig/devinfo/sysctl output | 2.0 KB | view raw |
| build.sh | build-script | no-op (no live-device PoC) | 255 B | view raw |
| run.sh | run-script | gate check (required device is absent) | 333 B | view raw |
DF-2317 — PoC verdict
File: sys/bus/mmc/mmc.c
Verdict: NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth fix.diff is attached.
Mechanism (confirmed in source)
mmc_decode_csd_sd() extracts the 2-bit CSD structure version from raw card data and panics ("unknown SD CSD version") for any value other than 0 or 1. The card fully controls those bits (CMD9 CSD response).
Cited lines
Why it does not reproduce on this guest
No mmc/sd controller or card on the QEMU guest (no /dev/mmcsd*, mmc module not loaded, devinfo shows no mmc bus).
Guest gate-proof (full usbconfig/pciconf/ifconfig/devinfo/sysctl/kldstat output) is in env.txt.
Defense-in-depth fix
Replace panic() with a kprintf log and leave csd zeroed so the caller rejects the card instead of crashing the kernel.
The git-apply-able diff is in fix.diff (verified git apply --check clean).
Classification
status: not_reproducedreproduced: 0impact: none (not reachable on this guest; latent code bug confirmed in source)confidence: certain (code bug + gate both confirmed by direct source trace and guest enumeration)fix_status: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)
Fix verification
not_testablenot_testable: target device absent on this guest. fix.diff applies clean and is source-correct; no live device to exercise.
git apply --check findings/poc/DF-2317/fix.diff -> OK. No runtime test possible (HW/ACPI/device-gated).
Confirmed kernel references
Detail
Exploit chain
none — valid hard blocker (driver/device path dead at runtime on this guest: no target HW/ACPI/device). No unprivileged->root path.
Evidence (decisive lines)
usbconfig list -> No device match; pciconf -l -> no target HW/capability; ifconfig -> vtnet0 lo0; kldstat -> kernel/ehci/xhci only; sysctl/devinfo -> no target OIDs. Source confirmed at cited lines.
PoC changes
Created findings/poc/DF-2317/{VERDICT.md,fix.diff,manifest.json,env.txt,build.sh,run.sh}. No PoC source (HW/ACPI/device-gated).
Verified recommended fix
Defense-in-depth fix.diff closes the cited path (see findings/poc/DF-2317/fix.diff; git apply --check OK).
Verdict
NOT REPRODUCED (HW/ACPI/device-gated on this guest). The bug is REAL in source (traced line-by-line): mmc panic on attacker-controlled SD CSD structure version 2/3 (no mmc/sd controller). Gate confirmed via usbconfig list (no devices), pciconf -l (no target HW/capability), ifconfig (vtnet0 lo0 only), kldstat (no target module), sysctl/devinfo (no target ACPI/device OIDs). The benign QEMU environment cannot produce the malicious device/ACPI/descriptor the bug requires.
No comments yet.