⬢ DragonFlyBSD Kernel Audit
DF-1075 / run.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
#!/bin/sh
# DF-1075 run script — demonstrates the bug mechanism via harness.
#
# The actual kue(4) driver bug requires physical USB hardware (a KLSI
# KL5KUSB101B USB-Ethernet adapter or a malicious USB gadget).  This guest
# has no USB devices, so we demonstrate the exact buggy allocation+write
# pattern (kmalloc(0) → ZERO_LENGTH_PTR → memcpy → page fault) via a
# kernel-module harness that replicates the if_kue.c code.
#
# STEP 1 (buggy pattern): loads the buggy harness — the kernel panics with
#   Fatal trap 12: page fault at 0xFFFFFFFFFFFFFFF8 (ZERO_LENGTH_PTR).
#   The guest goes down; the panic is captured in the serial boot log.
#
# STEP 2 (fixed pattern, on the FIXED kernel): loads the fixed-pattern
#   harness — kmalloc(192) returns a valid pointer, memcpy succeeds,
#   NO panic.
#
# Usage:  ./run.sh buggy    # on unpatched kernel (will crash the guest)
#         ./run.sh fixed    # on fixed kernel (no crash)
set -e
MODE="${1:-buggy}"

if [ "$MODE" = "buggy" ]; then
    echo "Loading BUGGY harness (expect Fatal trap 12: page fault at 0xFFFFFFFFFFFFFFF8)..."
    kldload /root/poc_df1075/df1075_harness.ko
elif [ "$MODE" = "fixed" ]; then
    echo "Loading FIXED-pattern harness (expect NO panic)..."
    kldload /root/poc_df1075_fixed/df1075_fixed.ko
    echo "Checking dmesg for harness output:"
    dmesg | tail -6
    kldunload df1075_fixed 2>/dev/null || true
else
    echo "Usage: $0 {buggy|fixed}" >&2
    exit 1
fi