⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2472

ISP_FC_GETDINFO ioctl missing channel bounds check -> kernel heap OOB read / info leak

Summary

ISP_FC_GETDINFO ioctl handler validates ifc->loopid against MAX_FC_TARG but never validates ifc->chan before indexing FCPARAM(isp ifc->chan)->portdb[ifc->loopid]. Every other channel-accepting ioctl (ISP_GETROLE ISP_SETROLE ISP_RESCAN ISP_FC_LIP ISP_FC_GETHINFO ISP_TSK_MGMT) performs explicit chan>=isp->isp_nchan guard; this one omits it. Local user in operator group can read up to ~30 bytes arbitrary kernel heap per call by supplying chan=1..63 on card whose isp_nchan is 1. ifc->chan 6-bit bitfield 0..63. isp_param allocated sizeof(fcparam)*isp_nchan. For nearly every FC card isp_nchan=1 so any chan>=1 reads past allocation. sizeof(fcparam)~25KB attacker can reach ~1.5MB into kernel heap controllable via chan/loopid. Device 0600 root:operator.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2472 · 6 files
FileTypeDescriptionSize
VERDICT.md verdict Source trace confirming DF-2472 bug is real but HW-gated 1.4 KB ↓ raw
fix.diff suggested-fix Add chan >= isp->isp_nchan bounds check matching sibling ioctls 372 B view raw
env.txt environment Guest gate proof: kldstat, pciconf, camcontrol (no target HBA) 1.1 KB view raw
build.sh build-script No buildable PoC (HW-gated) 384 B view raw
run.sh run-script Gate verification commands 411 B view raw
README.md readme Overview of HW-gated finding 791 B ↓ raw
README.md readme Overview of HW-gated finding
↓ download raw

HW-gated SCSI/FC HBA driver finding

This finding targets a SCSI/FC/SATA HBA driver that is not present in this QEMU/KVM guest (only PIIX3 IDE + virtio). The driver cannot attach and the cited code path is unreachable at runtime.

Reproduction status: NOT REPRODUCED (HW-gated)

  • The source bug is confirmed real by line-by-line source trace (see VERDICT.md).
  • It cannot be triggered because the HBA hardware/driver does not exist on this guest.
  • A defense-in-depth fix.diff has been authored and validated with git apply --check.

Evidence

  • VERDICT.md — full source trace and analysis
  • env.txt — guest environment (kldstat, pciconf, camcontrol gate proof)
  • fix.diff — git-apply-able defense-in-depth fix
  • manifest.json — machine-readable catalog
VERDICT.md verdict Source trace confirming DF-2472 bug is real but HW-gated
↓ download raw

DF-2472 — ISP_FC_GETDINFO ioctl missing channel bounds check

Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

Hardware gate

No QLogic ISP (FC/SCSI) HBA in guest: kldstat shows only kernel/ehci/xhci; pciconf -l shows no QLogic device; camcontrol devlist shows only QEMU DVD-ROM. The isp driver and its /dev/ispN ioctl surface do not exist on this guest.

Source trace (confirmed real bug)

File: sys/dev/disk/isp/isp_freebsd.c:471-495

The ISP_FC_GETDINFO ioctl handler validates ifc->loopid against MAX_FC_TARG (line 479) but never validates ifc->chan before indexing FCPARAM(isp, ifc->chan) at line 483. Every other channel-accepting ioctl in the same file has an explicit guard: ISP_GETROLE (line 378), ISP_SETROLE (line 392), ISP_RESCAN (line 441), ISP_FC_LIP (line 458), ISP_FC_GETHINFO (line 535), ISP_TSK_MGMT (line 576) — all check if (chan < 0 || chan >= isp->isp_nchan). This one omits it.

For nearly every FC card isp_nchan=1, so any chan >= 1 reads past the fcparam allocation (~25KB struct). ifc->chan is a 6-bit bitfield (0..63).

Fix

Added the same chan < 0 || chan >= isp->isp_nchan guard that sibling ioctls use. See fix.diff.

Impact (on HW that has the HBA)

Medium — kernel heap OOB read / info leak of up to ~30 bytes per call via the portdb[loopid] dereference. Device node is 0600 root:operator, so operator-group access suffices.

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

not_testable: target driver cannot attach (no target HBA). fix.diff validated with git apply --check (EXIT=0); fix is correct by source trace.

git apply --check findings/poc/DF-2472/fix.diff => EXIT=0. No runtime test possible (no target HBA).
↓ fix.diffDragonFly 6.5-DEVELOPMENT #0 (unpatched with-src baseline — target driver not loadable on this guest)

Confirmed kernel references

Detail

Exploit chain

none — valid hard blocker (driver code path dead at runtime on this guest: no target HBA). No unprivileged->root path.

Evidence (decisive lines)

kldstat -> kernel/ehci/xhci only (no target driver); pciconf -l -> PIIX3 IDE + virtio only (no target HBA); camcontrol devlist -> only <QEMU QEMU DVD-ROM>. Source confirmed at cited lines.

PoC changes

Created findings/poc/DF-2472/{VERDICT.md,fix.diff,manifest.json,env.txt,build.sh,run.sh,README.md}. No PoC source (HW-gated).

Verified recommended fix

Defense-in-depth fix.diff closes the cited path (see findings/poc/DF-2472/fix.diff; git apply --check OK).

Verdict

NOT REPRODUCED (HW-gated). The bug is REAL in source (traced line-by-line): isp_freebsd ISP_FC_GETDINFO ioctl missing channel bounds check (needs QLogic ISP FC + /dev/ispN). Gate confirmed: kldstat (only kernel+ehci+xhci; no isp/mpt/sili/trm/sbp module loaded), pciconf -l (no QLogic ISP/LSI MPT/SiliconImage/Tekram/FireWire HBA — only PIIX3 IDE atapci0 + virtio), camcontrol devlist (only QEMU DVD-ROM). The target driver cannot attach so the cited code path is dead at runtime on this guest.