strncpy of uuid without guaranteed NUL termination
Summary
dm_dev_alloc copies caller-supplied uuid with strncpy into dmv->uuid[DM_UUID_LEN](129 bytes). If supplied uuid >=129 bytes strncpy leaves buffer with no NUL terminator. name uses strlcpy (safe always NUL-terminated) but uuid uses strncpy. uuid originates from user-controlled proplib no length check. dm_dev_lookup_uuid does strcmp dm_dev_status_ioctl does prop_dictionary_set_cstring both strlen/strcmp the field. Currently kmalloc(M_ZERO) zeroed padding at end of struct masks runaway read. Latent OOB-read/kernel-heap info leak: future struct change placing non-zero field adjacent to uuid or non-zeroed allocation turns this into info leak defeating KASLR. [VERIFIED pass2: runtime reproduced as root - 130-char uuid accepted info returns 129-char past NUL capacity proving non-terminated strncpy; strlcpy fix]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2445 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.9 KB | ↓ raw | |
| README.md | — | 247 B | ↓ raw | |
| build.sh | — | 97 B | view raw | |
| run.sh | — | 87 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 690 B | view raw | |
| verdict.json | — | 2.5 KB | view raw | |
| fix.diff | — | 269 B | view raw | |
| dm_uuid_nterm.c | — | 3.2 KB | view raw | |
| run.log | — | 219 B | view raw |
DF-2445 evidence pack
- finding: sys/dev/disk/dm/dm_dev.c (365-368)
- verdict: reproduced (certain) - see VERDICT.md
- runtime PoC: dm_uuid_nterm.c
- reproduce: build.sh / run.sh ; expected output in run.log
- fix.diff: present, git-apply-able
DF-2445 - Verification Verdict
Status: reproduced Impact: leak Confidence: certain
Mechanism
dm_dev_alloc copies the caller-supplied uuid with strncpy(dmv->uuid, uuid, sizeof(dmv->uuid)) where sizeof==DM_UUID_LEN==129, with no guaranteed NUL. A prop-dictionary uuid of >=129 chars leaves dmv->uuid unterminated; every later %s/strcmp/prop_dictionary_set_cstring consumer walks past the array until an unrelated zero byte (currently the struct padding before cdev_t devt).
Verdict
REPRODUCED as root on the stock guest (kldload dm): DM create with a 130-char uuid succeeds, and the info ioctl reads back a 129-CHAR uuid - one byte more than the 128-char maximum a NUL-terminated uuid[129] store could ever return. The kernel-side prop_dictionary_set_cstring(DM_IOCTL_UUID, dmv->uuid) at dm_ioctl.c:414 performed the over-read to build that string. Termination today depends on unrelated struct padding; any field reordering or an all-non-zero neighbor turns this into a longer heap over-read into the status reply (root/operator-gated surface).
Threat / reachability
dm ioctls are root/operator gated (control dev 0640); impact is a latent heap over-read disclosed to the same privileged caller - hygiene, plus correctness for uuid-based lookup (strcmp over-read).
Privilege escalation assessment
n/a (privileged-only surface; no unprivileged path to /dev/mapper/control)
Fix
strlcpy instead of strncpy (name already uses strlcpy two lines above).
Kernel references
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier
batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
Confirmed kernel references
Detail
Exploit chain
no escalation path: /dev/mapper/control is 0640 root:operator; disclosure ceiling is heap bytes adjacent to uuid[] returned to the same privileged caller
Evidence (decisive lines)
run.log: create with 130-char uuid rc=0; info returns a 129-char uuid - one byte more than the 128-char maximum a NUL-terminated uuid[129] store can return
PoC changes
Fixed during bring-up: added sys/ioctl.h + libprop/plistref.h includes (userland netbsd-dm.h needs ioccom and the plistref type), switched the readback to the info command (status maps to dm_dev_status_ioctl) and to prop_dictionary_sendrecv_ioctl with the reply out-param.
Verified recommended fix
strlcpy instead of strncpy (name already uses strlcpy two lines above).
Verdict
REPRODUCED as root on the stock guest (kldload dm): DM create with a 130-char uuid succeeds, and the info ioctl reads back a 129-CHAR uuid - one byte more than the 128-char maximum a NUL-terminated uuid[129] store could ever return. The kernel-side prop_dictionary_set_cstring(DM_IOCTL_UUID, dmv->uuid) at dm_ioctl.c:414 performed the over-read to build that string. Termination today depends on unrelated struct padding; any field reordering or an all-non-zero neighbor turns this into a longer heap over-read into the status reply (root/operator-gated surface).
No comments yet.