scsi: wd33c93: fix buffer overflow in SCSI message-in handling

[PATCH] scsi: wd33c93: fix buffer overflow in SCSI message-in handling

Posted by Yuhao Jiang 3 months, 2 weeks ago

A buffer overflow vulnerability exists in the wd33c93 SCSI driver's
message handling where missing bounds checking allows a malicious
SCSI device to overflow the incoming_msg[] buffer and corrupt kernel
memory.

The issue occurs because:
- incoming_msg[] is a fixed 8-byte buffer (line 235 in wd33c93.h)
- wd33c93_intr() writes to incoming_msg[incoming_ptr] without
  validating incoming_ptr is within bounds (line 935)
- For EXTENDED_MESSAGE, incoming_ptr increments based on the device-
  supplied length field (line 1085) with no maximum check
- The validation at line 1001 only checks if the message is complete,
  not if it exceeds buffer size

This allows an attacker controlling a SCSI device to craft an extended
message with length field 0xFF, causing the driver to write 256 bytes
into an 8-byte buffer. This can corrupt adjacent fields in the
WD33C93_hostdata structure including function pointers, potentially
leading to arbitrary code execution.

Add bounds checking in the MESSAGE_IN handler to ensure incoming_ptr
does not exceed buffer capacity before writing. Reject oversized
messages per SCSI protocol by sending MESSAGE_REJECT.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Yuhao Jiang <danisjiang@gmail.com>
---
 drivers/scsi/wd33c93.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/scsi/wd33c93.c b/drivers/scsi/wd33c93.c
index dd1fef9226f2..2d50a0a01726 100644
--- a/drivers/scsi/wd33c93.c
+++ b/drivers/scsi/wd33c93.c
@@ -932,6 +932,19 @@ wd33c93_intr(struct Scsi_Host *instance)
 		sr = read_wd33c93(regs, WD_SCSI_STATUS);	/* clear interrupt */
 		udelay(7);
 
+		/* Prevent buffer overflow from malicious extended messages */
+		if (hostdata->incoming_ptr >= sizeof(hostdata->incoming_msg)) {
+			printk("wd33c93: Incoming message too long, rejecting\n");
+			hostdata->incoming_ptr = 0;
+			write_wd33c93_cmd(regs, WD_CMD_ASSERT_ATN);
+			hostdata->outgoing_msg[0] = MESSAGE_REJECT;
+			hostdata->outgoing_len = 1;
+			write_wd33c93_cmd(regs, WD_CMD_NEGATE_ACK);
+			hostdata->state = S_CONNECTED;
+			spin_unlock_irqrestore(&hostdata->lock, flags);
+			break;
+		}
+
 		hostdata->incoming_msg[hostdata->incoming_ptr] = msg;
 		if (hostdata->incoming_msg[0] == EXTENDED_MESSAGE)
 			msg = EXTENDED_MESSAGE;
-- 
2.34.1

Re: [PATCH] scsi: wd33c93: fix buffer overflow in SCSI message-in handling

Posted by Christoph Hellwig 3 months, 2 weeks ago

This exploit really needs a catchy name.  Just think of how much
valuable data you could extract by selling malicious fake 8-bit
SCSI disks to retro computing enthusiasts and then exploiting their
SCSI HBA driver.

On Mon, Oct 20, 2025 at 09:08:04PM -0500, Yuhao Jiang wrote:
> A buffer overflow vulnerability exists in the wd33c93 SCSI driver's
> message handling where missing bounds checking allows a malicious
> SCSI device to overflow the incoming_msg[] buffer and corrupt kernel
> memory.
> 
> The issue occurs because:
> - incoming_msg[] is a fixed 8-byte buffer (line 235 in wd33c93.h)
> - wd33c93_intr() writes to incoming_msg[incoming_ptr] without
>   validating incoming_ptr is within bounds (line 935)
> - For EXTENDED_MESSAGE, incoming_ptr increments based on the device-
>   supplied length field (line 1085) with no maximum check
> - The validation at line 1001 only checks if the message is complete,
>   not if it exceeds buffer size
> 
> This allows an attacker controlling a SCSI device to craft an extended
> message with length field 0xFF, causing the driver to write 256 bytes
> into an 8-byte buffer. This can corrupt adjacent fields in the
> WD33C93_hostdata structure including function pointers, potentially
> leading to arbitrary code execution.
> 
> Add bounds checking in the MESSAGE_IN handler to ensure incoming_ptr
> does not exceed buffer capacity before writing. Reject oversized
> messages per SCSI protocol by sending MESSAGE_REJECT.
> 
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yuhao Jiang <danisjiang@gmail.com>
> ---
>  drivers/scsi/wd33c93.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/drivers/scsi/wd33c93.c b/drivers/scsi/wd33c93.c
> index dd1fef9226f2..2d50a0a01726 100644
> --- a/drivers/scsi/wd33c93.c
> +++ b/drivers/scsi/wd33c93.c
> @@ -932,6 +932,19 @@ wd33c93_intr(struct Scsi_Host *instance)
>  		sr = read_wd33c93(regs, WD_SCSI_STATUS);	/* clear interrupt */
>  		udelay(7);
>  
> +		/* Prevent buffer overflow from malicious extended messages */
> +		if (hostdata->incoming_ptr >= sizeof(hostdata->incoming_msg)) {
> +			printk("wd33c93: Incoming message too long, rejecting\n");
> +			hostdata->incoming_ptr = 0;
> +			write_wd33c93_cmd(regs, WD_CMD_ASSERT_ATN);
> +			hostdata->outgoing_msg[0] = MESSAGE_REJECT;
> +			hostdata->outgoing_len = 1;
> +			write_wd33c93_cmd(regs, WD_CMD_NEGATE_ACK);
> +			hostdata->state = S_CONNECTED;
> +			spin_unlock_irqrestore(&hostdata->lock, flags);
> +			break;
> +		}
> +
>  		hostdata->incoming_msg[hostdata->incoming_ptr] = msg;
>  		if (hostdata->incoming_msg[0] == EXTENDED_MESSAGE)
>  			msg = EXTENDED_MESSAGE;
> -- 
> 2.34.1
> 
> 
---end quoted text---