DF-4598 — vinum_scandisk() strncpy into partname[64] without NUL termination (stack OOB read)

• File: sys/dev/raid/vinum/vinumio.c:723
• Severity: Info · Confidence: likely

What

char partname[DRIVENAMELEN];      /* DRIVENAMELEN = 64 (local #define, line 677) */
...
if (has_slice >= 0 && has_part)
    strncpy(partname, devicename[driveno], DRIVENAMELEN);

When the user-supplied device path is ≥ 64 characters and its basename matches the [a-z]+\d+s\d<c> scan pattern, strncpy fills all 64 bytes and leaves partname unterminated. check_drive(partname) → find_drive_by_dev() → on create, ksnprintf(drive->devicename, 64, "%s", partname) (vinumconfig.c:534-536) then reads past the 64-byte stack buffer until it happens to find a NUL — a bounded-by-luck stack overread whose content is copied into the created drive's devicename (visible to the same root user via vinum l).

The sibling constructors (ksnprintf(partname, DRIVENAMELEN, …) at 725/728) are safe; only the strncpy branch is affected. The device list comes from the read ioctl tokens (root) or the vinum.drives loader tunable, so this is a hardening/info finding, not an attack surface for unprivileged users.

Fix

-   strncpy(partname, devicename[driveno], DRIVENAMELEN);
+   strncpy(partname, devicename[driveno], DRIVENAMELEN - 1);
+   partname[DRIVENAMELEN - 1] = '\0';

Not run on the guest

Requires a ≥64-char matching device path from root; the overread's target content is stack noise with no privilege consequence. Recorded as untested.

DF-4598 — VERDICT

Status: untested (Info-severity hardening finding; root/loader-input only, no guest run).

Analysis

sys/dev/raid/vinum/vinumio.c:723 — the has_slice >= 0 && has_part branch of vinum_scandisk() uses strncpy(partname, devicename[driveno], DRIVENAMELEN) with partname[64]. A device path of ≥ 64 characters whose basename matches the %*[a-z]%*d%*[s]%d%c scan shape (ksscanf, line 711) yields an unterminated partname. The first consumer that treats it as a C string is find_drive_by_dev()'s create path (ksnprintf(drive->devicename, sizeof(...), "%s", devname), vinumconfig.c:534-536) — a stack overread whose length is bounded only by the first accidental NUL. The copied bytes land in the new drive's devicename, inspectable by the same root user. The strcmp in the search loop terminates safely because the comparison operand is a NUL-terminated ≤63-byte devicename. No unprivileged path; recorded as Info.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)