DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2465

Stack over-read via strcmp/kprintf on non-NUL-terminated copyinstr result in i_setopt digest handling

Summary

i_setopt uses digsize=6 to copy user-supplied digest algorithm name via copyinstr into 6-byte stack buffer then compares with strcmp against CRC32C. String CRC32C is exactly 6 characters (7 bytes with NUL) so copyinstr copies all 6 bytes WITHOUT NUL terminator returns ENAMETOOLONG. Error guard != EFAULT admits ENAMETOOLONG so strcmp runs on non-NUL-terminated stack buffer reading past hdigest[5]/ddigest[5] into adjacent kernel stack. sdebug %s hdigest also over-reads via kprintf. CRC32C PDU integrity protection never reliably activates. Impact: kernel stack over-read CWE-125 bounded by nearest NUL. Debug builds console/log leak. Root only (/dev/iscsiN 0600).

Discussion (0)

No comments yet.