DragonFlyBSD Kernel Audit
DF-0876 / run.log
← back to finding ↓ download raw
harness.c: In function 'sig_segv':
  write(2, buf, n);
  ^~~~~
  ^~~~~
BUILD_OK
[*] sizeof(struct ext2_gd)        = 64 bytes
[*] offsetof(ext4bgd_csum)        = 30 bytes

[A] desc_size=0     (legitimate rev0 GD):
    csum=0x8cb0   OOB read length = 0 bytes (expected 0)

[B] desc_size=64    (legitimate 64bit GD):
    csum=0x2c9a   read length    = 32 bytes (32..64 within GD)

[C] desc_size=0xFFFF (attacker-controlled, METADATA_CKSUM only):
    csum=0x2c9a   read length    = 65503 bytes
    OOB read: gd+32 .. gd+65535 (length 65503)
    struct ext2_gd ends at gd+64
    -> read extends 65471 bytes PAST the 64-byte struct ext2_gd.

[D] Invoking ext2_gd_csum_faulting (full ext2_csum.c:684-686 read):
    GD at 0x800473fc0 (end of page 1); next page PROT_NONE at 0x800474000
    Expecting SIGSEGV at 0x800474000 (= gd+64 = start of PROT_NONE page).

[!] SIGSEGV caught during csum read at addr 0x0000000800474000
HARNESS_RC=133