lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 3 Aug 2020 11:07:57 +0800
From:   Jia-Ju Bai <>
Subject: Re: [PATCH] scsi: esas2r: fix possible buffer overflow caused by bad
 DMA value in esas2r_process_fs_ioctl()

On 2020/8/2 23:47, James Bottomley wrote:
> On Sun, 2020-08-02 at 23:21 +0800, Jia-Ju Bai wrote:
>> Because "fs" is mapped to DMA, its data can be modified at anytime by
>> malicious or malfunctioning hardware. In this case, the check
>> "if (fsc->command >= cmdcnt)" can be passed, and then "fsc->command"
>> can be modified by hardware to cause buffer overflow.
> This threat model seems to be completely bogus.  If the device were
> malicious it would have given the mailbox incorrect values a priori ...
> it wouldn't give the correct value then update it.  For most systems we
> do assume correct operation of the device but if there's a worry about
> incorrect operation, the usual approach is to guard the device with an
> IOMMU which, again, would make this sort of fix unnecessary because the
> IOMMU will have removed access to the buffer after the command
> completed.

Thanks for the reply :)

In my opinion, IOMMU is used to prevent the hardware from accessing 
arbitrary memory addresses, but it cannot prevent the hardware from 
writing a bad value into a valid memory address.
For this reason, I think that the hardware can normally access 
"fsc->command" and modify it into arbitrary value at any time, because 
IOMMU considers the address of "fsc->command" is valid for the hardware.

Best wishes,
Jia-Ju Bai

Powered by blists - more mailing lists