⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2440

_table() passes DM_MAX_PARAMS_SIZE instead of remaining buffer space to ksnprintf (latent OOB-write enabler)

Summary

dm_target_delay_table composes status string by repeatedly calling _table()/ksnprintf into DM_MAX_PARAMS_SIZE(1024) buffer advancing p by value returned by ksnprintf (would-have-written not actual written) then passing DM_MAX_PARAMS_SIZE (not remaining slack) as size to next ksnprintf. _table also passes DM_MAX_PARAMS_SIZE rather than remaining. If field bound ever widened p would jump past params+1024 and subsequent ksnprintf would write past buffer. No demonstrated impact today (udev_name bounded 32 bytes). Hardening/defense-in-depth. [VERIFIED pass2: source-confirmed ksnprintf size-basis error unreachable with current widths; remaining-space fix compile-validated]

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2440 · 8 files
FileTypeDescriptionSize
VERDICT.md — 1.6 KB ↓ raw
README.md — 246 B ↓ raw
build.sh — 85 B view raw
run.sh — 49 B view raw
env.txt — 314 B view raw
manifest.json — 631 B view raw
verdict.json — 2.0 KB view raw
fix.diff — 1.2 KB view raw
README.md
↓ download raw

DF-2440 evidence pack

  • finding: sys/dev/disk/dm/delay/dm_target_delay.c (183-201)
  • verdict: reproduced (certain) - see VERDICT.md
  • source-only confirmation (no runtime PoC)
  • reproduce: build.sh / run.sh
  • fix.diff: present, git-apply-able
VERDICT.md
↓ download raw

DF-2440 - Verification Verdict

Status: reproduced Impact: none (hardening) Confidence: certain

Mechanism

dm_target_delay_table advances p through the DM_MAX_PARAMS_SIZE buffer but passes DM_MAX_PARAMS_SIZE (the FULL size) as the ksnprintf limit at every step (_table() and the space separator), so the remaining-space accounting is wrong once p > params.

Verdict

source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Latent OOB-write enabler: with the current field widths (udev_name %d:%d, uint64 offset, int delay, twice) the strings cannot approach 512 bytes, so no overflow is reachable today; the fix makes the bound real. Root-gated dm surface.

Threat / reachability

Latent buffer accounting bug on a root-gated status path; cannot overflow with current field widths.

Privilege escalation assessment

n/a (hardening)

Fix

Pass the remaining space (DM_MAX_PARAMS_SIZE - (p - params)) into _table and the separator ksnprintf.

Kernel references

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Note: an earlier draft of this fix.diff failed the first combined build (see _batch41/README.md); the shipped diff is the corrected, compile-clean version.

Fix verification

not_testable

fix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier

batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
↓ fix.diffper-fix-DF-2440

Confirmed kernel references

Detail

Exploit chain

no escalation path (Info-tier hardening; see VERDICT.md)

Evidence (decisive lines)

VERDICT.md mechanism/verdict sections; fix.diff

PoC changes

none (source-only confirmation for this Info-tier item)

Verified recommended fix

Pass the remaining space (DM_MAX_PARAMS_SIZE - (p - params)) into _table and the separator ksnprintf.

Verdict

source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Latent OOB-write enabler: with the current field widths (udev_name %d:%d, uint64 offset, int delay, twice) the strings cannot approach 512 bytes, so no overflow is reachable today; the fix makes the bound real. Root-gated dm surface.