DragonFlyBSD Kernel Audit
DF-1064 / run.log
← back to finding ↓ download raw
=== DMESG ===
DF1064: direct-OOB: CPUID_TO_ACPIID(256)=0xDF1064 -> cpu_id_to_acpi_id[256] clobbered (OOB CONFIRMED)
DF1064: lapic_set_cpuid(256,1): lapic_mem low word set to 1 (OOB via lapic_set_cpuid CONFIRMED)
DF1064: AFTER restore: cpu_id_to_apic_id[256]=0  lapic_mem=0  cpu_id_to_acpi_id[256]=0x0  apic_id_to_cpu_id[1]=1
DF1064: SUMMARY: OOB WRITE CONFIRMED -- cpu-dimension OOB at index 256 in cpu_id_to_apic_id (->lapic_mem low word) and cpu_id_to_acpi_id (->madt_use_x2apic)
DF1064: harness unloaded
DF1064: lapic_set_cpuid=0xffffffff80bdd180
DF1064: cpu_id_to_apic_id=0xffffffff818da120  [256]=0xffffffff818da520
DF1064: cpu_id_to_acpi_id=0xffffffff81b25220  [256]=0xffffffff81b25620
DF1064: &lapic_mem=0xffffffff818da520  (low-4-byte alias via [256] of cpu_id_to_apic_id)
DF1064: aliasing check: &cpu_id_to_apic_id[256]==(int*)&lapic_mem ? YES
DF1064: BEFORE OOB: cpu_id_to_apic_id[256]=0  lapic_mem=0  cpu_id_to_acpi_id[256]=0x0  apic_id_to_cpu_id[1]=1
DF1064: direct-OOB: CPUID_TO_ACPIID(256)=0xDF1064 -> cpu_id_to_acpi_id[256] clobbered (OOB CONFIRMED)
DF1064: lapic_set_cpuid(256,1): lapic_mem low word set to 1 (OOB via lapic_set_cpuid CONFIRMED)
DF1064: AFTER restore: cpu_id_to_apic_id[256]=0  lapic_mem=0  cpu_id_to_acpi_id[256]=0x0  apic_id_to_cpu_id[1]=1
DF1064: SUMMARY: OOB WRITE CONFIRMED -- cpu-dimension OOB at index 256 in cpu_id_to_apic_id (->lapic_mem low word) and cpu_id_to_acpi_id (->madt_use_x2apic)