⬢ DragonFlyBSD Kernel Audit
DF-2237 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-2237",
  "file": "sys/libiconv/iconv_xlat16.c",
  "title": "iconv_xlat16_conv NULL-deref after case-conversion index mutation",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "severity": "Medium",
  "reproduce": {
    "build": "sh /root/df2237/build.sh  (guest, after vm.sh reset with-src + scp of pack)",
    "run": "p0_controls.sh; snapshot df2237-built; p1_trigger_single.sh; p2_trigger_double.sh; pf_fix.sh",
    "expected": "stock: Fatal trap 12 supervisor READ, fault VA 0x108 (T1) and 0xc (T2) inside iconv_xlat16_conv; patched module: controls bit-identical, both triggers SURVIVED ret=-1, no panic"
  },
  "kernel_refs": [
    "sys/libiconv/iconv_xlat16.c:142",
    "sys/libiconv/iconv_xlat16.c:155-158",
    "sys/libiconv/iconv_xlat16.c:163",
    "sys/libiconv/iconv_xlat16.c:186-189",
    "sys/libiconv/iconv_xlat16.c:192",
    "sys/libiconv/iconv.c:397-443",
    "sys/vfs/msdosfs/msdosfs_conv.c:903",
    "sys/vfs/msdosfs/msdosfs_conv.c:988",
    "lib/libkiconv/xlat16_iconv.c:258-266"
  ],
  "artifacts": [
    "armtbl.c", "df2237_mod.c", "mmap0.c", "build.sh",
    "p0_controls.sh", "p1_trigger_single.sh", "p2_trigger_double.sh", "pf_fix.sh",
    "build.log", "run.log", "dmesg.txt",
    "run_t1.log", "t1_boot.log", "panic.txt",
    "run_t2.log", "t2_boot.log", "panic2.txt",
    "fix.diff", "fixbuild.log", "fix_build.log",
    "fix_controls.log", "fix_dmesg.txt", "fix_run.log", "fix_boot.log", "fix_t1.log",
    "env.txt", "mmap0_user.log", "mmap0_root.log",
    "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}