DF-2465
Stack over-read via strcmp/kprintf on non-NUL-terminated copyinstr result in i_setopt digest handling
Summary
i_setopt uses digsize=6 to copy user-supplied digest algorithm name via copyinstr into 6-byte stack buffer then compares with strcmp against CRC32C. String CRC32C is exactly 6 characters (7 bytes with NUL) so copyinstr copies all 6 bytes WITHOUT NUL terminator returns ENAMETOOLONG. Error guard != EFAULT admits ENAMETOOLONG so strcmp runs on non-NUL-terminated stack buffer reading past hdigest[5]/ddigest[5] into adjacent kernel stack. sdebug %s hdigest also over-reads via kprintf. CRC32C PDU integrity protection never reliably activates. Impact: kernel stack over-read CWE-125 bounded by nearest NUL. Debug builds console/log leak. Root only (/dev/iscsiN 0600).
No comments yet.