DragonFlyBSD Kernel Audit
DF-0050 / leak_sample.txt
← back to finding ↓ download raw
# DF-0050 leak sample across 3 runs (single-msg queue, fresh IPC_PRIVATE each run)
--- run 1 ---
msg_first = 0xfffff8008e0ea998
msg_last  = 0xfffff8008e0ea998
msg_pad1  = 0x0000000000000000
msg_pad2  = 0x0000000000000000
msg_pad3  = 0x0000000000000000
msg_pad4[0] = 0x0000000000000000
msg_pad4[1] = 0x0000000000000000
msg_pad4[2] = 0x0000000000000000
msg_pad4[3] = 0x0000000000000000
LEAK: msg_first is a non-zero kernel pointer (uid=1001 KASLR/heap-ASLR bypass)
OK: msg_first == msg_last (single-msg queue)
--- run 2 ---
msg_first = 0xfffff8008e0ea998
msg_last  = 0xfffff8008e0ea998
msg_pad1  = 0x0000000000000000
msg_pad2  = 0x0000000000000000
msg_pad3  = 0x0000000000000000
msg_pad4[0] = 0x0000000000000000
msg_pad4[1] = 0x0000000000000000
msg_pad4[2] = 0x0000000000000000
msg_pad4[3] = 0x0000000000000000
LEAK: msg_first is a non-zero kernel pointer (uid=1001 KASLR/heap-ASLR bypass)
OK: msg_first == msg_last (single-msg queue)
--- run 3 ---
msg_first = 0xfffff8008e0ea998
msg_last  = 0xfffff8008e0ea998
msg_pad1  = 0x0000000000000000
msg_pad2  = 0x0000000000000000
msg_pad3  = 0x0000000000000000
msg_pad4[0] = 0x0000000000000000
msg_pad4[1] = 0x0000000000000000
msg_pad4[2] = 0x0000000000000000
msg_pad4[3] = 0x0000000000000000
LEAK: msg_first is a non-zero kernel pointer (uid=1001 KASLR/heap-ASLR bypass)
OK: msg_first == msg_last (single-msg queue)

# Two-message queue (msg_first != msg_last, both leaked):
first=0xfffff8008e0ea998 last=0xfffff8008e0ea980 same=0