DF-4443
vtpci_intr_alloc does not clamp the caller's interrupt count to the fixed vtpci_intr_res[1 + VIRTIO_MAX_VIRTQUEUES] array — latent out-of-bounds softc state write for any child driver requesting more than 9 vectors
Summary
The only downward clamp is to pci_msix_count() - fully controlled by the (potentially malicious) host. The MSI-X loop writes vtpci_intr_res[i].rid for i in [0,*cnt) with no check against the array bound 9; the finish loop writes ires_sc/irq pointers into the same array. Contrast vtpci_alloc_virtqueues, which does validate nvqs. All four in-tree children clamp safely (vtnet/vtblk/vtscsi/balloon) so no reachable path today - transport API-contract/hardening defect. Clamp-at-entry fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4443 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.3 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
clamp *cnt to 1+VIRTIO_MAX_VIRTQUEUES at entry (finding markdown diff)
per-fix-DF-4443
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
No unprivileged or in-tree path: all four in-tree children clamp cnt<=8. Requires privileged attacker-authored kmod + cooperating host. Defect certain by inspection (array bound :98-106 vs unclamped loop indices :484-514/:541-554; the in-function clamp :474-475 is to the host-controlled pci_msix_count).
Verdict
not_run: Low/hardening; needs out-of-tree kmod + malicious host; transport API-contract defect mirroring the nvqs guard the file already has
No comments yet.