⬢ DragonFlyBSD Kernel Audit
DF-0874 / harness_A.out
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
=== DF-0874 harness ===
f_dirblbuf         = 4096 bytes (kmalloc)
INDEX_ROOT rdsize = 122 bytes (valid data)
evil entry[0]     : reclen=0xfff0 ie_flag=0 (NOT LAST)
terminal LAST     : ABSENT (crafted)
residue [122..4096)  : 0xdeadc0de (INVARIANTS poison)

[subr.c:1176 BOUNDED walk] find entry 0:
  walked to off=32 (rdsize=122): IN-BOUNDS (safe)
  returned @ off 32: ie_number=0x41414141 reclen=0xfff0 ie_flag=0x00000000

[vnops.c:585 UNBOUNDED walk] from returned entry:
  [vnops] reclen==0 at off=65552 -> kernel infinite-loop hang (DoS)
  steps=2  max_off=65552 (bufsz=4096, rdsize=122)  oob_derefs=1
  => BUG CONFIRMED: ntfs_readdir dereferenced index entries 1 time(s) PAST the INDEX_ROOT valid data (rdsize=122) using attacker reclen=0xfff0 as stride.