DF-0234 / run.sh
#!/bin/sh # DF-0234 build/run - source-trace confirmed; latent on this QEMU guest. # No userspace trigger compiles a binary because the vulnerable path requires a # registered hardware watchdog (amdsbwd/ichwd) not present here. set -e cd "$(dirname "$0")" echo "DF-0234: signed-integer overflow in wdog_reset_all() min_period*hz/2" echo " (sys/kern/kern_wdog.c:105). Source-trace confirmed." echo " Demonstrate the list is EMPTY on this guest (path latent):" if command -v sysctl >/dev/null 2>&1; then sysctl kern.watchdog.auto kern.watchdog.period 2>/dev/null echo "--- dmesg wdog (no 'Watchdog X registered' => empty list => early return) ---" dmesg | grep -i wdog fi echo "DF-0234: arithmetic proof: min_period*hz (hz=1000) overflows int for" echo " min_period > 2147483 (INT_MAX/1000). Initial min_period=INT_MAX." echo " Confirmed latent (needs amdsbwd/ichwd HW driver). See VERDICT.md." |