DragonFlyBSD Kernel Audit
DF-0825 / run.2.log
← back to finding ↓ download raw
---run 2---
DF-0825: harness start
DF-0825: calling nfs_getnickauth(nmp, cred uid=1001, ...)
DF-0825: nickname planted = 0xdeadbeef
DF-0825: RPCAKN_NICKNAME = 1, txdr = 0x01000000
DF-0825: nfs_getnickauth returned error=0
DF-0825: auth_str = 0xfffff8008d3846a4, auth_len = 8
DF-0825: auth_str[0..3]  = 0xdeadbeef
DF-0825: auth_str[4..7]  = 0x00000000  (<= OOB heap if bug present)
DF-0825: expected[0..3]  = 0x00000001 (RPCAKN_NICKNAME)
DF-0825: expected[4..7]  = 0xdeadbeef (nickname)
DF-0825: raw bytes at auth_str: deadbeef 00000000 00000000 00000000
DF-0825: *** BUG CONFIRMED ***
DF-0825:   auth_str[0] = nickname 0xdeadbeef, NOT RPCAKN_NICKNAME
DF-0825:   => auth_str points 4 bytes past allocation base
DF-0825:   => auth_str[4..7] = 0x00000000 is OOB heap read
DF-0825:   => caller kfree(auth_str) frees non-base ptr => slab corruption
DF-0825: now calling kfree(auth_str) to demonstrate slab corruption...
DF-0825: kfree returned (no panic => INVARIANTS may be off or slab was lucky)
DF-0825: harness done
---run 3---
DF-0825: harness start
DF-0825: calling nfs_getnickauth(nmp, cred uid=1001, ...)
DF-0825: nickname planted = 0xdeadbeef
DF-0825: RPCAKN_NICKNAME = 1, txdr = 0x01000000
DF-0825: nfs_getnickauth returned error=0
DF-0825: auth_str = 0xfffff8004f0c2914, auth_len = 8
DF-0825: auth_str[0..3]  = 0xdeadbeef
DF-0825: auth_str[4..7]  = 0x00000000  (<= OOB heap if bug present)
DF-0825: expected[0..3]  = 0x00000001 (RPCAKN_NICKNAME)
DF-0825: expected[4..7]  = 0xdeadbeef (nickname)
DF-0825: raw bytes at auth_str: deadbeef 00000000 00000000 00000000
DF-0825: *** BUG CONFIRMED ***
DF-0825:   auth_str[0] = nickname 0xdeadbeef, NOT RPCAKN_NICKNAME
DF-0825:   => auth_str points 4 bytes past allocation base
DF-0825:   => auth_str[4..7] = 0x00000000 is OOB heap read
DF-0825:   => caller kfree(auth_str) frees non-base ptr => slab corruption
DF-0825: now calling kfree(auth_str) to demonstrate slab corruption...
DF-0825: kfree returned (no panic => INVARIANTS may be off or slab was lucky)
DF-0825: harness done