DragonFlyBSD Kernel Audit
DF-0641 / harness_run.log
← back to finding ↓ download raw
$ cc -O2 -o overflow_harness overflow_harness.c && ./overflow_harness
vc_pass (original password)        : 128 bytes
pbuf after UTF-8->ISO8859-1 iconv  : 64 bytes (SHORTENED)
plen  = strlen(pbuf)+1              : 65
uniplen = plen*2  (kmalloc size)    : 130
smb_strtouni writes (from vc_pass)  : 258 bytes
==> HEAP OVERFLOW                   : 128 bytes
overflow content: attacker-controlled (Unicode expansion of pw)
RESULT: ntencpass (slab bucket for 130) overflows by 128 bytes => kernel heap corruption (C:H/I:H/A:H)
HARNESS_RC=0