ioctl transfer lengths are accepted unbounded and flow into kmalloc(M_WAITOK|M_ZERO)/copyin/copyout: native au_length is a 64-bit unsigned long (up to 2^64-1), the linux generic path's imax(inlen,outlen) sign-extends a negative int through amr_ioctl_buffer_length, and the linux PASS path allocates the card-supplied ap_data_transfer_length — oversized-allocation panic, unbounded kernel-memory pinning, and a round_page() wrap hazard in the oversized-slab path
Summary
Three length sources reach kmalloc with no cap: native au_length (unsigned long; >64KB passes unrounded; >2^63 sign-wraps through the oversized-slab path where round_page wraps to 0); the linux generic path sign-extends imax(inlen,outlen) via int->ULONG_MAX; the PASS path allocates the fully user-supplied ap_data_transfer_length, NULL-unchecked. copyin/copyout stay bounded by the allocation - allocation abuse/arithmetic, not linear overflow. Clamp-at-helper + reject-negative + NULL-check fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4062 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 287 B | ↓ raw | |
| verdict.json | file | 1.0 KB | view raw |
DF-4062
Hardware-gated finding - PoC skipped (no device on audit guest). Source citations in the pass-2 result block.
Fix: amr_ioctl_buffer_length returns error or clamps for len > 64KB; reject negative int inlen/outlen; cap ap_data_transfer_length; NULL-check the PASS-path kmalloc
Fix verification
not_testableamr_ioctl_buffer_length returns error or clamps for len > 64KB; reject negative int inlen/outlen; cap ap_data_transfer_length; NULL-check the PASS-path kmalloc
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; path:line citations in pass-2 result block
Verdict
source-verified; hardware-gated (no device on audit guest); no guest run per allocation
No comments yet.