Kernel heap info leak via uninitialized DMA buffer in MPTIO_READ_CFG_PAGE / MPTIO_READ_EXT_CFG_PAGE
Summary
Per-ioctl DMA scratch buffer allocated by mpt_alloc_buffer via bus_dmamem_alloc WITHOUT BUS_DMA_ZERO so contains stale kernel heap. In READ_CFG_PAGE and READ_EXT_CFG_PAGE paths only page header (4 or 8 bytes) copyin before controller asked to fill it controller writes only true page size (PageLength*4) or zero on error. Handler then copyout full user-supplied len (up to 16MB) returning uninitialized kernel heap bytes to userspace. busdma_machdep only ORs M_ZERO when BUS_DMA_ZERO passed kmalloc does not zero by default. mpt_user_read_cfg_page returns 0 unconditionally so copyout always runs. Bytes [4..len) or [8..len) uninitialized kernel heap handed to userland. /dev/mptN 0640 root:operator operator-group sufficient.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2486 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source trace confirming DF-2486 bug is real but HW-gated | 1.2 KB | ↓ raw |
| fix.diff | suggested-fix | Add BUS_DMA_ZERO to bus_dmamem_alloc in mpt_alloc_buffer | 455 B | view raw |
| env.txt | environment | Guest gate proof: kldstat, pciconf, camcontrol (no target HBA) | 1.1 KB | view raw |
| build.sh | build-script | No buildable PoC (HW-gated) | 384 B | view raw |
| run.sh | run-script | Gate verification commands | 411 B | view raw |
| README.md | readme | Overview of HW-gated finding | 791 B | ↓ raw |
HW-gated SCSI/FC HBA driver finding
This finding targets a SCSI/FC/SATA HBA driver that is not present in this QEMU/KVM guest (only PIIX3 IDE + virtio). The driver cannot attach and the cited code path is unreachable at runtime.
Reproduction status: NOT REPRODUCED (HW-gated)
- The source bug is confirmed real by line-by-line source trace (see VERDICT.md).
- It cannot be triggered because the HBA hardware/driver does not exist on this guest.
- A defense-in-depth
fix.diffhas been authored and validated withgit apply --check.
Evidence
VERDICT.md— full source trace and analysisenv.txt— guest environment (kldstat, pciconf, camcontrol gate proof)fix.diff— git-apply-able defense-in-depth fixmanifest.json— machine-readable catalog
DF-2486 — Kernel heap info leak via uninitialized DMA buffer
Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED
Hardware gate
No LSI Logic MPT HBA in guest: kldstat shows only kernel/ehci/xhci; pciconf -l
shows no LSI device. No /dev/mptN device node exists.
Source trace (confirmed real bug)
File: sys/dev/disk/mpt/mpt_user.c:203 (and ioctl switch at 672-685, 698-711)
mpt_alloc_buffer calls bus_dmamem_alloc at line 203 **without BUS_DMA_ZERO``,
so the buffer contains stale kernel heap. In theMPTIO_READ_CFG_PAGEpath (line
672-686): only the 4-byte page header is copyin'd before the IOC fills the page;
the handler thencopyouts the full user-suppliedlen(up to 16MB) at line 685,
returning bytes[4..len)as uninitialized kernel heap. Same forMPTIO_READ_EXT_CFG_PAGEat 711 (bytes[8..len)).busdma_machdeponly ORsM_ZEROwhenBUS_DMA_ZEROis passed;kmalloc` does not zero by default.
Fix
Added BUS_DMA_ZERO to the bus_dmamem_alloc call in mpt_alloc_buffer.
See fix.diff.
Impact (on HW that has the HBA)
Medium — kernel heap info leak of up to 16MB per ioctl call. Device node is
0640 root:operator, operator-group access suffices.
Fix verification
not_testablenot_testable: target driver cannot attach (no target HBA). fix.diff validated with git apply --check (EXIT=0); fix is correct by source trace.
git apply --check findings/poc/DF-2486/fix.diff => EXIT=0. No runtime test possible (no target HBA).
Confirmed kernel references
Detail
Exploit chain
none — valid hard blocker (driver code path dead at runtime on this guest: no target HBA). No unprivileged->root path.
Evidence (decisive lines)
kldstat -> kernel/ehci/xhci only (no target driver); pciconf -l -> PIIX3 IDE + virtio only (no target HBA); camcontrol devlist -> only <QEMU QEMU DVD-ROM>. Source confirmed at cited lines.
PoC changes
Created findings/poc/DF-2486/{VERDICT.md,fix.diff,manifest.json,env.txt,build.sh,run.sh,README.md}. No PoC source (HW-gated).
Verified recommended fix
Defense-in-depth fix.diff closes the cited path (see findings/poc/DF-2486/fix.diff; git apply --check OK).
Verdict
NOT REPRODUCED (HW-gated). The bug is REAL in source (traced line-by-line): mpt_user kernel heap info leak via uninitialized DMA buffer (no BUS_DMA_ZERO; needs LSI MPT + /dev/mptN). Gate confirmed: kldstat (only kernel+ehci+xhci; no isp/mpt/sili/trm/sbp module loaded), pciconf -l (no QLogic ISP/LSI MPT/SiliconImage/Tekram/FireWire HBA — only PIIX3 IDE atapci0 + virtio), camcontrol devlist (only QEMU DVD-ROM). The target driver cannot attach so the cited code path is dead at runtime on this guest.
No comments yet.