⬢ DragonFlyBSD Kernel Audit
DF-1215 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
{
  "finding_id": "DF-1215",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Authorization bypass REPRODUCED with unmodified production code: a KLD rig (/dev/bktrig0 -> production video_ioctl() from the stock unfixed /boot/kernel/bktr.ko, synthetic post-attach softc) let uid=1001 METEORSVIDEO an arbitrary physical DMA target (addr=0x100000 -> rc=0, METEORGVIDEO readback 0x100000) -- the exact field every bt848 RISC DMA builder consumes (bktr_core.c:2670/2841/2996/3114/3215) -- with no privilege check anywhere in the driver (nodes 0444, bktr_os.c:325). The corruption SINK (bt848 bus-master DMA write) cannot fire on this guest: QEMU has no Brooktree PCI device (pciconf: none; /dev/bktr0 ENOENT, re-verified), so no panic/uid0 is demonstrable here -- hence inconclusive rather than reproduced, and not not_reproduced (nothing failed; the bypass half did reproduce). On real bt848 hardware the stored target makes METEORCAPTUR DMA attacker-deterministic bytes to arbitrary physical memory -> ucred/function-pointer overwrite -> uid=0 (no SMAP/SMEP/KASLR). Fix VALIDATED behaviorally this run: DF1215FIX kernel (GENERIC+device bktr+fix.diff, nativekernel rc=0 315s) -> identical rig+user gets EPERM for addr!=0, addr=0 path intact, root retains redirect.",
  "exploit_chain": "On real bt848 hardware: open /dev/bktr0 O_RDONLY (mode 0444, any user) -> ioctl METEORSVIDEO addr=<victim phys addr> (no auth, bktr_core.c:1396) -> ioctl BT848_SCBARS for deterministic payload bytes -> ioctl METEORCAPTUR METEOR_CAP_CONTINOUS (no auth, bktr_core.c:1502) -> bt848 bus-master writes frame bytes to arbitrary phys -> overwrite struct ucred cr_uid or function pointer -> uid=0. NOT exercisable on this guest: chain blocked at the DMA engine (no bt848 PCI emulation); only the METEORSVIDEO acceptance half was rig-reproduced.",
  "evidence": "run.log (combined decisive run); baseline_rig_run.log (THE ATTACK: uid=1001 METEORSVIDEO addr=0x100000 rc=0, readback 0x100000); rig_load.log (production bktr.ko loaded, video_ioctl=0xffffffff82606190); baseline_run.log (/dev/bktr0 ENOENT, no bt848 PCI); fixed_rig_run.log (EPERM on fixed kernel); fixed_root_run.log (root retains redirect); fix_build.log/fix_install.log (DF1215FIX rc=0); VERDICT.md for the full narrative",
  "kernel_refs": [
    "sys/dev/video/bktr/bktr_core.c:1202",
    "sys/dev/video/bktr/bktr_core.c:1396",
    "sys/dev/video/bktr/bktr_core.c:1398",
    "sys/dev/video/bktr/bktr_core.c:1502",
    "sys/dev/video/bktr/bktr_core.c:2670",
    "sys/dev/video/bktr/bktr_core.c:2841",
    "sys/dev/video/bktr/bktr_core.c:2996",
    "sys/dev/video/bktr/bktr_core.c:3114",
    "sys/dev/video/bktr/bktr_core.c:3215",
    "sys/dev/video/bktr/bktr_os.c:325",
    "sys/dev/video/bktr/bktr_os.c:615",
    "sys/dev/video/bktr/bktr_os.c:643",
    "sys/conf/files:1916"
  ],
  "poc_changes": "poc_physdma.c unchanged. Added poc_rig.c + KLD rig (bktrig.c / bktrig_nodep.c): production video_ioctl is a global symbol so the rig dispatches /dev/bktrig0 ioctls to it on a synthetic zeroed bktr_softc (bigbuf!=0 = post-attach state); fixed include path (dev/video/bktr/ioctl_bt848.h), added <sys/device.h> (struct dev_ops lives there in this tree), kld build via bsd.kmod.mk + device_if.h/bus_if.h copied from /usr/obj kernel dir, kldload by full path; nodep variant (MODULE_DEPEND seded out) for the fix kernel where bktr is compiled in; fixed seeded bzero(&g,0xAA) length/pattern swap -> memset(&g,0xAA,sizeof(g)).",
  "attempts": 6,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1380,
  "guest_dirty": 0,
  "build_cmd": "guest: (maxx) cc -O2 -Wall -o poc_physdma poc_physdma.c; cc -O2 -Wall -o poc_rig poc_rig.c; (root /root/bktrig[/nodep]) make -m /usr/src/share/mk SYSDIR=/usr/src/sys -- see rig_setup.sh / build.sh",
  "run_cmd": "guest: (root once) kldload /root/bktrig/bktrig.ko; (maxx) ./poc_rig -- see run.sh",
  "code_hash": "936fa27d01c6283da366ca6164c88262547f768eeb5fa89b087bc0a10a38fad8",
  "notes": "Pass-1 verdict (inconclusive, build-only fix validation) upgraded: auth-bypass half now behaviorally demonstrated with UNMODIFIED production handler; fix validation upgraded not_testable -> fixed via behavioral A/B on DF1215FIX (same rig, same uid). Guest reset to with-src snapshot after testing (clean). Secondary hardening worth considering: 0444 -> 0600 node perms and gating METEORCAPTUR too. bktrig.c sha256=0be7d496fb6b4b0a37c8e3c055978f0b94a325c471c6eb3ecd147895cc82678b.",
  "recommended_fix": "Gate METEORSVIDEO redirect on caps_priv_check_td(td, SYSCAP_RESTRICTEDROOT) when video->addr != 0 (fix.diff; behaviorally validated); additionally consider 0600 device nodes and an auth check on METEORCAPTUR.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "DF1215FIX kernel (X86_64_GENERIC + device bktr + fix.diff; nativekernel rc=0 in 315s, -Werror clean; installkernel rc=0; boot-stable, kern.version #0 Sun Oct 11 21:52:44 UTC 2026). Identical rig + identical uid=1001 attack: METEORSVIDEO addr=0x100000 -> EPERM (baseline: rc=0 acceptance via unfixed production bktr.ko), METEORGVIDEO readback 0x0, addr=0 kernel-buffer mode still rc=0, root retains redirect (rc=0, readback 0x100000). Bad behavior GONE, legitimate use preserved.",
  "fix_evidence": "fix_run.log (combined A/B); fixed_rig_run.log (EPERM); fixed_root_run.log (root contrast); fix_build.log (full nativekernel log, rc=0); fix_install.log; fixed_rig_load.log (video_ioctl kernel global 0xffffffff80830790 on DF1215FIX); patched-source gate at sys/dev/video/bktr/bktr_core.c:1409",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Sun Oct 11 21:52:44 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/DF1215FIX  x86_64"
}