DragonFlyBSD Kernel Audit
DF-0778 / leak_sample.txt
← back to finding ↓ download raw
DF-0778 Mode A leak sample (di_size=200, di_blocks=0, readlink as unprivileged maxx)
Shortlink buffer (i_shortlink = di_db) is 48 bytes; readlink returned 200 bytes.
Bytes 48..199 (152 bytes) are OOB kernel memory leaked to userspace.

readlink returned 200 bytes (shortlink buffer is only 48)
--- hexdump (first 256 bytes) ---
41414141 41414141 41414141 41414141  | AAAAAAAAAAAAAAAA|
41414141 41414141 41414141 41414141  | AAAAAAAAAAAAAAAA|
41414141 41414141 41414141 41410000  | AAAAAAAAAAAAAA..|
00000000 00000000 00000000 00000000  | ................|
00000000 3826a475 00000000 00000000  | ....8&.u........|
00000000 00000000 00000000 00000000  | ................|
00000000 00000000 00000000 00000000  | ................|
3033a38d 00f8ffff ffffffff 04000000  | 03..............|
d856ac8d 00f8ffff 00000000 00000000  | .V..............|
00000000 00000000 00000000 00000000  | ................|
7025a38d 00f8ffff 24000000 04000000  | p%......$.......|
04000000 08000000 400ca98d 00f8ffff  | ........@.......|
3033a38d 00f8ffff 
--- bytes after offset 48 (past i_shortlink): 152 ---
LEAKED_KERNEL_PTRS=5