Ignored acpi_PkgInt32 return values leak uninitialized kernel stack via sysctl read
Summary
hci_call() discards return value of acpi_PkgInt32() at :442 and :445. If HCI/GHCI AML returns package whose element[0] is Integer(0)=HCI_SUCCESS but element[2] not ACPI_TYPE_INTEGER (Buffer/String faulty/missing) then status set to 0 success while *arg never written. Caller acpi_toshiba_sysctl() passes uninitialized stack UINT32 arg (:292) to sysctl_handle_int() (:307) which copies 4 bytes uninitialized kernel stack to any unprivileged reader (SYSCTL_OUT). Independently :442 reads ret uninitialized when element[0] non-integer before if(ret==HCI_SUCCESS) test. sysctls CTLFLAG_ANYBODY any local user can read. Leak materializes when firmware GHCI returns non-integer element[2] for GET while HCI_SUCCESS in element[0] - faulty/attacker-supplied ACPI tables. [VERIFIED pass2: reproduced - uid 1001 reads of all five ANYBODY nodes return deterministic kernel-stack garbage stable x5 with hci_call succeeding and arg never written; error-return fix-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2394 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 594 B | ↓ raw | |
| VERDICT.md | — | 1.5 KB | ↓ raw | |
| env.txt | — | 145 B | view raw | |
| fix.diff | — | 601 B | view raw | |
| fixed.log | — | 233 B | view raw | |
| run.log | — | 451 B | view raw | |
| run.sh | — | 121 B | view raw | |
| verdict.json | — | 1.8 KB | view raw |
DF-2394 - toshiba hci_call ignored acpi_PkgInt32 -> stack leak
Rig (ACHARNESS + ssdt_acsim TOS0, GHCI returns
Package(6){0 /AX success/, 0x15, "notanint" /CX String/, 0,0,0}) Unprivileged reads: hw.acpi.toshiba.force_fan -> 33554416 hw.acpi.toshiba.video_output -> 0 hw.acpi.toshiba.lcd_brightness -> 524287 hw.acpi.toshiba.lcd_backlight -> -2048 hw.acpi.toshiba.cpu_speed -> 524287 (stable across 5 rounds - deterministic per-node stack residue)
Fixed kernel (fix.diff: check both acpi_PkgInt32 results)
All five reads return errors; no value disclosed.
DF-2394 VERDICT
Status: reproduced (reproduced) Impact: leak Confidence: certain Attempts: 2
Unprivileged (uid 1001) reads of all five CTLFLAG_ANYBODY toshiba sysctls returned deterministic kernel-stack garbage - 33554416 (0x2000050), 0, 524287 (0x7FFFF), -2048 (0xFFFFF800), 524287 - none AML-provided: the rigged GHCI returns HCI_SUCCESS in element[0] with element[2] (CX) as a String, so the ignored acpi_PkgInt32 at acpi_toshiba.c:442/:445 leaves hci_call reporting success with *arg never written, and acpi_toshiba_sysctl (UINT32 arg at :292) SYSCTL_OUTs the uninitialized stack. Five stable per-node garbage values across 5 rounds. Fixed kernel: reads return errors.
Kernel references
sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:292sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:442sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:445sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:307
Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS x86_64
Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
unprivileged 4-byte kernel stack disclosure per node read on Toshiba HCI firmware that returns a non-integer CX with success status (faulty or attacker-supplied ACPI tables)
Evidence (decisive lines)
run.log (5 nodes x 5 rounds: 33554416/0/524287/-2048/524287, uid=1001); fixed.log (reads return errors)
PoC changes
no PoC existed; sysctl sweep written for this batch
Verified recommended fix
see fix.diff
Verdict
Unprivileged (uid 1001) reads of all five CTLFLAG_ANYBODY toshiba sysctls returned deterministic kernel-stack garbage - 33554416 (0x2000050), 0, 524287 (0x7FFFF), -2048 (0xFFFFF800), 524287 - none AML-provided: the rigged GHCI returns HCI_SUCCESS in element[0] with element[2] (CX) as a String, so the ignored acpi_PkgInt32 at acpi_toshiba.c:442/:445 leaves hci_call reporting success with *arg never written, and acpi_toshiba_sysctl (UINT32 arg at :292) SYSCTL_OUTs the uninitialized stack. Five stable per-node garbage values across 5 rounds. Fixed kernel: reads return errors.
No comments yet.