DF-4585
mpt_dump_sgl called with offset=0 on interior/stack pointers: bounded SGL walk overshoots the request area and hex-dumps up to ~504 bytes of kernel stack past an 8-byte stack union
Summary
dump_sgl derives its limit as se + (512 - offset), assuming se is the request-area base; two callers pass offset=0 with an interior SGL pointer (+0x20, walking 32 bytes into the adjacent DMA slot) or an 8-byte stack union (walking ~504 bytes of kernel stack). The AUTO_GOOD_STATUS path never initializes StatusDataSGE, so zeroed flags guarantee the walk continues past the stack copy. Info leak into console/dmesg; gated by mpt verbose boot-kenv. NOTE: this file has no ioctl layer (mpt_user.c owns /dev/mptN, root:operator 0640). Correct-displacement fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4585 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: hardware absent / latent
fix in finding markdown
per-fix-DF-4585
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
dump_sgl's walk limit assumes se is the 512-byte request-area base; two callers pass offset=0 with interior (+0x20) or 8-byte-stack-union pointers, and the AUTO_GOOD_STATUS path never initializes StatusDataSGE so zeroed flags guarantee the walk continues past the stack copy. Correct-displacement + dump-from-request-buffer fix.
Verdict
not_run: requires LSI mpt HBA in target mode + boot-kenv mpt_debug1..3 (root-set); no mpt HBA on guest
No comments yet.