Heap OOB read+write via unbounded sense_len in autosense bcopy
Summary
On SCSI_STATUS_CHECK_COND/CMD_TERMINATED completion adw_intr() copies autosense data with bcopy(&acb->sense_data &ccb->csio.sense_data ccb->csio.sense_len). sense_len is attacker-influenced u_int8_t (range 0..255) copied verbatim from userland by xpt_merge_ccb via pass(4) and in-kernel storage on both ends only 32 bytes (SSD_FULL_SIZE). sense_len bounded to sizeof(acb->sense_data) when told to firmware (:384) but NOT when copying back out. sense_len of 255 reads 223 bytes past acb->sense_data into adjacent acb fields (kernel heap pointers) and writes them past ccb->csio.sense_data into adjacent csio fields. Info-leak primitive ~200 bytes per call KASLR-bypass-grade kernel heap info leak. mpt SIM bounds this same op with min(). [VERIFIED pass2: reproduced - unclamped sense_len 255 bcopy leaks acb link pointer bytes into CAM sense data AND corrupts cdb_len via OOB write past sense_data; min() clamp fix-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2416 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 294 B | ↓ raw | |
| VERDICT.md | — | 1.4 KB | ↓ raw | |
| build.sh | — | 78 B | view raw | |
| dfadw.c | — | 8.3 KB | view raw | |
| env.txt | — | 254 B | view raw | |
| fix.diff | — | 509 B | view raw | |
| manifest.json | — | 701 B | view raw | |
| run.log | — | 1.2 KB | view raw | |
| run.sh | — | 110 B | view raw | |
| verdict.json | — | 1.9 KB | view raw |
DF-2416 -- evidence pack
Verdict: reproduced (reproduced=1, impact=none, confidence=certain)
Build: see build.sh (dfadw.ko)
Run: sysctl kern.dfadwgo="run 255"
See VERDICT.md for the full narrative, run.log/panic.txt for the decisive output, fix.diff for the post-verification fix.
DF-2416 VERDICT
Status: reproduced Impact: none Confidence: certain
Production adw_intr CHECK_COND completion with user-supplied sense_len=255 executed the unclamped bcopy at adwcam.c:1321-1322: the 32-byte in-bounds 0xEE fill followed by the planted acb->links.sle_next pointer bytes (48 47 46 45 44 20 42 41 = 0x4142434445464748) and post-acb heap canary (0x6d) landed in ccb->csio.sense_data and past it; ccb->csio.cdb_len was corrupted to 0x47 (a byte of the leaked pointer overwrote it). Both the OOB read (acb tail: kernel pointer + heap) and the OOB write (223 bytes past csio.sense_data into neighboring CCB fields) demonstrated in one production dispatch; guest alive.
Kernel references
sys/dev/disk/advansys/adwcam.c:384sys/dev/disk/advansys/adwcam.c:1321sys/dev/disk/advansys/adwcam.c:1322
Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Notes
same root cause class as DF-1510 (adwcam autosense); the mpt driver bounds this exact op with min()
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
pass(4) CCB with sense_len=255 + CHECK_COND from target -> bcopy reads acb tail (kernel pointers) into the CAM-visible sense buffer and writes past it corrupting csio fields
Evidence (decisive lines)
run.log (before/after sense_data dumps, planted-pointer bytes visible, cdb_len corrupted)
PoC changes
fabricated adw_softc/carriers/acb/ccb exactly as adw_execute_ccb leaves them + real CAM SIM/path registered by the rig (same calls adw_attach makes); production adw_intr from the kernel
Verified recommended fix
cl->sense_len, sizeof(ccb->csio.sense_data));
Verdict
Production adw_intr CHECK_COND completion with user-supplied sense_len=255 executed the unclamped bcopy at adwcam.c:1321-1322: the 32-byte in-bounds 0xEE fill followed by the planted acb->links.sle_next pointer bytes (48 47 46 45 44 20 42 41 = 0x4142434445464748) and post-acb heap canary (0x6d) landed in ccb->csio.sense_data and past it; ccb->csio.cdb_len was corrupted to 0x47 (a byte of the leaked pointer overwrote it). Both the OOB read (acb tail: kernel pointer + heap) and the OOB write (223 bytes past csio.sense_data into neighboring CCB fields) demonstrated in one production dispatch; guest alive.
No comments yet.