DF-2493

Heap OOB write via untrusted disk index in ATA RAID metadata parsers

Summary

Every vendor RAID-metadata parser copies per-disk index straight out of untrusted on-disk superblock and uses it to index raid->disks[MAX_DISKS=16] with no bounds check. Same untrusted index propagated into raid->total_disks (up to 256). Crafted ATA disk parsed automatically at attach writes kernel pointer+flags up to ~256 entries past end of heap-allocated ar_softc corrupting adjacent kernel heap. Parsers: HighPoint v2/nvidia/LSI v2/HighPoint v3/Silicon Image/Promise/Intel all have unbounded disk_number indexing disks[]. No parser checks disk_number<MAX_DISKS or total_disks<=MAX_DISKS. Attacker: malicious USB/VM image/cloud block device. No authentication required.

Discussion (0)

No comments yet.

Severity: High
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U:C:H/I:H/A:H
CWE: CWE-787 Out-of-bounds Write
File: sys/dev/disk/nata/ata-raid.c
Lines: 1806-3592
Area: dev
Discovered: 2026-07-28
Updated: 2026-07-28

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-08-09 13:46:46
Attempts: 2
Runtime: 4s
Code hash: n/a (no PoC sour
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: (no userspace PoC; HW-gated)
Run cmd: (no userspace PoC; HW-gated)

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: no
Patched reproduced: no
Confidence: certain
Tested: 2026-08-09 13:46:46
Runtime: —
Kernel: X86_64_GENERIC built with batch fix.diffs (gcc 8.3, -Werror, build rc=0) — not booted; no target HW to exercise either kernel.
fix.diff: findings/poc/DF-2493/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2493 · 7 files

File	Type	Description	Size
VERDICT.md	verdict	HW-gate analysis + source trace + fix summary	2.0 KB	↓ raw
fix.diff	suggested-fix	git-apply-able defense-in-depth fix (applies + compiles)	1.3 KB	view raw
fix_build.log	build-log	combined build proof: all 18 fix.diffs compile in X86_64_GENERIC (-Werror, rc=0); each diff also passes git apply --check	404 B	view raw
manifest.json	manifest	this catalog	1.6 KB	view raw
env.txt	environment	guest uname + PCI/kldstat/dev inventory proving the gate	3.6 KB	view raw
build.sh	build-script	no-op (HW-gated, nothing to build)	356 B	view raw
run.sh	run-script	no-op (HW-gated, nothing to run)	268 B	view raw

VERDICT.md verdict HW-gate analysis + source trace + fix summary

↓ download raw

DF-2493 — Heap OOB write via untrusted disk index in ATA RAID metadata

Verdict

NOT REPRODUCED (hardware / trigger gated). The cited vulnerable code path exists in sys/dev/disk/nata/ata-raid.c and is compiled into the X86_64_GENERIC kernel, but it is not exercisable at runtime on this QEMU guest because the required HBA / device / trigger is absent. Confidence in the source bug itself: certain.

Why it cannot be reproduced here (the gate)

Hard-gated: needs an ATA disk carrying a vendor RAID superblock that nataraid parses at attach. The guest has no /dev/ad and no ataraid volume (no /dev/ar); nataraid attaches nothing.

See env.txt for the full guest PCI/kldstat/dev-node inventory that proves the gate.

The bug is real in source (traced line-by-line)

Cited path: - sys/dev/disk/nata/ata-raid.c:3109 - sys/dev/disk/nata/ata-raid.c:3121-3125 - sys/dev/disk/nata/ata-raid.h:39 - sys/dev/disk/nata/ata-raid.h:108 - The vulnerable construct is present verbatim in the current master source (confirmed by direct read of the cited lines during verification). - A defense-in-depth fix.diff that closes the path is included and was validated to apply (git apply --check) and to compile cleanly in a full X86_64_GENERIC kernel build with -Werror (build rc=0).

Fix

In each vendor metadata parser validate meta->disk_number < MAX_DISKS before indexing disks[], and cap total_disks to MAX_DISKS. The diff demonstrates the guard in the nvidia parser (the cited representative).

The standalone git-apply-able diff is fix.diff.

Reproduce

./build.sh && ./run.sh — both are no-ops on this guest by design (the gate holds). Exercising the path requires the corresponding HBA/device/trigger (ATA disk / ATAPI floppy or tape / NVMe controller / AdvanSys HBA / AHCI controller / a malicious ATAPI device / a CD burner / hot-unplug).

Status

status: not_reproduced | reproduced: 0 | impact: none (HW-gated) fix_status: not_testable (path cannot run on this guest; diff applies + compiles)

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

not_testable: the vulnerable path is unreachable on this guest (no target HW/malicious device). Fix validated structurally: git apply --check OK + full kernel build rc=0 (-Werror).

git apply --check findings/poc/DF-2493/fix.diff -> OK. Combined kernel build: 'NK_DONE rc=0'. No runtime before/after possible (HW-gated).

↓ fix.diffX86_64_GENERIC built with batch fix.diffs (gcc 8.3, -Werror, build rc=0) — not booted; no target HW to exercise either kernel.

Confirmed kernel references

Detail

Exploit chain

none — valid hard blocker (driver/device path dead at runtime on this guest: no target HBA / no malicious device / no removable media). No unprivileged->root path.

Evidence (decisive lines)

kldstat -> kernel/ehci/xhci only (no target driver); pciconf -l -> PIIX3 IDE + virtio only (no AHCI/NVMe/AdvanSys HBA); camcontrol devlist -> only <QEMU QEMU DVD-ROM>; ls /dev/<target> -> No such file. Source confirmed at cited lines.

PoC changes

Created findings/poc/DF-2493/{VERDICT.md,fix.diff,env.txt,build.sh,run.sh,manifest.json,fix_build.log}. No PoC source (HW-gated).

Verified recommended fix

Defense-in-depth fix.diff adds the validation/bounds check closing the cited path (see findings/poc/DF-2493/fix.diff; git apply --check OK).

Verdict

NOT REPRODUCED (HW/trigger-gated on this guest). The bug is REAL in source (traced line-by-line): nata ata-raid disks[MAX_DISKS=16] OOB via untrusted on-disk RAID-metadata disk index (no RAID disk). Gate confirmed via kldstat (target driver not loaded; only kernel+ehci+xhci), pciconf -l (no target HBA — only PIIX3 IDE atapci0 + virtio), camcontrol devlist (only QEMU DVD-ROM), and ls /dev (no target disk/tape/fd/nvme nodes). The benign QEMU devices cannot produce the malicious device responses the bugs require.