Heap OOB read via zero-element ACPI SIF package - no count check before o[0]
Summary
aibs_attach_sif() accesses o[0] (where o=bp->Package.Elements) without first verifying bp->Package.Count>=1. ACPICAs AcpiUtCopyIpackageToEpackage sets Package.Elements=Buffer+sizeof(ACPI_OBJECT) for zero-element package exactly past end of allocated buffer. o[0].Type read dereferences OOB pointer reading ~56 bytes past heap allocation. AcpiEvaluateObjectTyped only validates top-level Type==ACPI_TYPE_PACKAGE does not check element count so Package(0){} passes type check. Attacker: malicious ACPI table DSDT/SSDT with Method(VSIF) Return(Package(0){}). OOB read data used only for internal comparison not copied to userspace - worst case panic if crosses unmapped page unlikely in kernel heap. [PASS-2 NOTE: DF-2395 duplicates DF-2006 - one zero-element-?SIF root; fold on triage] [VERIFIED pass2: INCONCLUSIVE rig-limited - verbatim aibs attach with empty-SIF reply wedged the harness before the read logged; source-certain OOB read, DUPLICATE of DF-2006; Count-lt-1 fix compile-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2395 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 900 B | ↓ raw | |
| VERDICT.md | — | 1.6 KB | ↓ raw | |
| env.txt | — | 145 B | view raw | |
| fix.diff | — | 399 B | view raw | |
| run.log | — | 660 B | view raw | |
| run.sh | — | 121 B | view raw | |
| verdict.json | — | 1.9 KB | view raw |
DF-2395 - aibs zero-element SIF package OOB read: RIG-INCOMPLETE
Attempt (aib_shim.c: verbatim atk0110.c + interposed
AcpiEvaluateObjectTyped returning Package(0){} with Elements either in canary-sprayed padding or at an unmapped page edge) Both attach attempts wedged the harness guest before the o[0].Type read produced any log line - a rig failure (the verbatim driver attach path interacts badly with the fake-child interposition in this kernel), not the production behavior.
Source (certain)
bp = b.Pointer; o = bp->Package.Elements; / atk0110.c:169-170 / if (o[0].Type != ACPI_TYPE_INTEGER) { ... / :171 - OOB for Count==0 / ACPICA UtCopyIpackageToEpackage sets Elements = buffer+sizeof(ACPI_OBJECT) for Package(0){} - one past the allocation.
fix.diff (compile-validated): explicit bp->Package.Count < 1 check
before the Elements[0] dereference. Duplicate of DF-2006.
DF-2395 VERDICT
Status: inconclusive Impact: corruption Confidence: likely Attempts: 2
Rig could not complete a clean capture: the verbatim aibs attach with the interposed empty-?SIF reply wedged the harness guest before any o[0] read was logged (both canary mode and page-edge mode; the wedge is a rig/interposition failure, not the production behavior), and the page-edge proof technique was separately unavailable because the DFly kernel_map is densely mapped (no unmapped neighbor found for kmem_alloc pages). Source analysis is airtight: aibs_attach_sif dereferences o = bp->Package.Elements then o[0].Type with no Count check (atk0110.c:169-171) and for Package(0){} ACPICA sets Elements past the allocation - a heap OOB read whose value steers the driver. Duplicate of DF-2006 as noted. fix.diff (Count<1 check) compile-validated.
Kernel references
sys/dev/acpica/aibs/atk0110.c:169sys/dev/acpica/aibs/atk0110.c:170sys/dev/acpica/aibs/atk0110.c:171
Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS x86_64
Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
run.log (aibsim mode=1/2 attach attempts, guest wedge before read logged); source trace VERDICT.md
PoC changes
aib_shim.c verbatim-interposition harness written for this batch (AcpiEvaluateObjectTyped interposer with canary/page-edge empty-package modes); rig wedge prevented the capture
Verified recommended fix
see fix.diff
Verdict
Rig could not complete a clean capture: the verbatim aibs attach with the interposed empty-?SIF reply wedged the harness guest before any o[0] read was logged (both canary mode and page-edge mode; the wedge is a rig/interposition failure, not the production behavior), and the page-edge proof technique was separately unavailable because the DFly kernel_map is densely mapped (no unmapped neighbor found for kmem_alloc pages). Source analysis is airtight: aibs_attach_sif dereferences o = bp->Package.Elements then o[0].Type with no Count check (atk0110.c:169-171) and for Package(0){} ACPICA sets Elements past the allocation - a heap OOB read whose value steers the driver. Duplicate of DF-2006 as noted. fix.diff (Count<1 check) compile-validated.
No comments yet.