DF-4993
SMB_BWRITE silently truncates wcount to u_char: 256..1024-byte block writes are short/zero-length yet return success
Summary
The clamp bound (1024) exceeds the ABI width (u_char) of the bwrite count param - 1024->0 bytes transmitted with success. Shortens only. Clamp-to-255 fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4993 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 655 B | view raw |
Fix verification
not_testableper-fix-DF-4993
Confirmed kernel references
Detail
Exploit chain
SMB_BWRITE wcount=1024 -> 0 bytes on the wire, returns 0
Evidence (decisive lines)
findings/poc/DF-4993/ (this verdict)
Verdict
Silent truncation, root-gated (Info): wcount clamped to [0,1024] but the SMBUS_BWRITE count param is u_char - 256->0, 300->44, 1024->0 bytes transmitted while the ioctl returns success (the header advertises the 1024 limit). Shortens only; no memory unsafety. Clamp-to-255 fix (or E2BIG).
No comments yet.