This exploit really needs a catchy name. Just think of how much valuable data you could extract by selling malicious fake 8-bit SCSI disks to retro computing enthusiasts and then exploiting their SCSI HBA driver.
On Mon, Oct 20, 2025 at 09:08:04PM -0500, Yuhao Jiang wrote:
A buffer overflow vulnerability exists in the wd33c93 SCSI driver's message handling where missing bounds checking allows a malicious SCSI device to overflow the incoming_msg[] buffer and corrupt kernel memory.
The issue occurs because:
- incoming_msg[] is a fixed 8-byte buffer (line 235 in wd33c93.h)
- wd33c93_intr() writes to incoming_msg[incoming_ptr] without validating incoming_ptr is within bounds (line 935)
- For EXTENDED_MESSAGE, incoming_ptr increments based on the device- supplied length field (line 1085) with no maximum check
- The validation at line 1001 only checks if the message is complete, not if it exceeds buffer size
This allows an attacker controlling a SCSI device to craft an extended message with length field 0xFF, causing the driver to write 256 bytes into an 8-byte buffer. This can corrupt adjacent fields in the WD33C93_hostdata structure including function pointers, potentially leading to arbitrary code execution.
Add bounds checking in the MESSAGE_IN handler to ensure incoming_ptr does not exceed buffer capacity before writing. Reject oversized messages per SCSI protocol by sending MESSAGE_REJECT.
Reported-by: Yuhao Jiang danisjiang@gmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Yuhao Jiang danisjiang@gmail.com
drivers/scsi/wd33c93.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
diff --git a/drivers/scsi/wd33c93.c b/drivers/scsi/wd33c93.c index dd1fef9226f2..2d50a0a01726 100644 --- a/drivers/scsi/wd33c93.c +++ b/drivers/scsi/wd33c93.c @@ -932,6 +932,19 @@ wd33c93_intr(struct Scsi_Host *instance) sr = read_wd33c93(regs, WD_SCSI_STATUS); /* clear interrupt */ udelay(7);
/* Prevent buffer overflow from malicious extended messages */if (hostdata->incoming_ptr >= sizeof(hostdata->incoming_msg)) {printk("wd33c93: Incoming message too long, rejecting\n");hostdata->incoming_ptr = 0;write_wd33c93_cmd(regs, WD_CMD_ASSERT_ATN);hostdata->outgoing_msg[0] = MESSAGE_REJECT;hostdata->outgoing_len = 1;write_wd33c93_cmd(regs, WD_CMD_NEGATE_ACK);hostdata->state = S_CONNECTED;spin_unlock_irqrestore(&hostdata->lock, flags);break;}- hostdata->incoming_msg[hostdata->incoming_ptr] = msg; if (hostdata->incoming_msg[0] == EXTENDED_MESSAGE) msg = EXTENDED_MESSAGE;
-- 2.34.1
---end quoted text---