Partial MMIO key read returns success without zeroing unfilled buffer tail enabling uninitialized-stack leak through sysctl
Summary
apple_smc_mmio_key_read() reads only min(HW-reported rlen len) bytes into callers buffer but returns success (0) without zeroing buf[rlen..len-1]. ISA backend always fills exactly len bytes so callers assume full buffer initialized. Several sysctl handlers (apple_smc_clkt_sysctl apple_smc_msps_sysctl apple_smc_mbp_sysctl_light_left_10byte) do not memset stack buffers and decode/return all len bytes to userspace leaking uninitialized kernel stack if SMC firmware reports rlen<len. Precondition: SMC firmware reports shorter data length (not attacker-triggerable on stock hardware). Defense-in-depth. [VERIFIED pass2: HW-gated no T2; short device reads leave stack tail behind sysctl; bzero fix compile-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2402 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.2 KB | ↓ raw | |
| README.md | — | 237 B | ↓ raw | |
| build.sh | — | 95 B | view raw | |
| run.sh | — | 49 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 621 B | view raw | |
| verdict.json | — | 1.9 KB | view raw | |
| fix.diff | — | 327 B | view raw |
DF-2402 evidence pack
- finding: sys/dev/apple/smc/smc_mmio.c (75-81)
- verdict: not_reproduced (certain) - see VERDICT.md
- source-only confirmation (no runtime PoC)
- reproduce: build.sh / run.sh
- fix.diff: present, git-apply-able
DF-2402 - Verification Verdict
Status: not_reproduced Impact: leak Confidence: certain
Mechanism
apple_smc_mmio_key_read clamps rlen=min(device_len, len), fills buf[0..rlen) and returns 0 WITHOUT touching buf[rlen..len); the sysctl handler exposes the full len from a stack buffer, so a short device response discloses the uninitialized tail to sysctl readers.
Verdict
NOT REPRODUCED (hardware/module-gated on this QEMU guest) - code-certain line-level confirmation in the read-only sys/ tree. Apple T2 SMC MMIO hardware absent in the QEMU guest; leak-by-omission confirmed at code level.
Threat / reachability
Requires the named hardware/module; see VERDICT.md.
Privilege escalation assessment
n/a (device-gated)
Fix
bzero(buf, len) before filling (or zero only the tail).
Kernel references
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier
batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
Confirmed kernel references
Detail
Exploit chain
no escalation path (Info-tier hardening; see VERDICT.md)
Evidence (decisive lines)
VERDICT.md mechanism/verdict sections; fix.diff
PoC changes
none (source-only confirmation for this Info-tier item)
Verified recommended fix
bzero(buf, len) before filling (or zero only the tail).
Verdict
NOT REPRODUCED (hardware/module-gated on this QEMU guest) - code-certain line-level confirmation in the read-only sys/ tree. Apple T2 SMC MMIO hardware absent in the QEMU guest; leak-by-omission confirmed at code level.
No comments yet.