⬢ DragonFlyBSD Kernel Audit
DF-2253 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-2253",
  "title": "sep==NULL misplaces NUL terminator and truncates output",
  "file": "sys/libkern/hexncpy.c",
  "lines": [56, 62],
  "verdict": "reproduced",
  "impact": "none",
  "reproduce": {
    "build": "sh build.sh  (guest: harness + pseudo-device tap into kernel, make -j6 nativekernel KERNCONF=X86_64_GENERIC + installkernel, reboot); cc -O2 -o /root/arp_inject arp_inject.c",
    "run": "sh run.sh   (guest: sysctl kern.df_hexncpy=1 -> matrix C4/C5/C6; ifconfig tap0 create+up; /root/arp_inject; dmesg | grep arp)",
    "expected": "stock kernel: C5 (if_ether.c:643 exact shape, ar_hrd 0x1234) -> out=[1]; C4 inlen=6 -> deadbeef123; C6 inlen=4 -> deadbee; live ARP log line: arp: unknown hardware address format (0x1). patched kernel: C5 -> 1234; C4 -> deadbeef1234; C6 -> deadbeef; ARP log: (0x1234); sep!=NULL control byte-identical"
  },
  "kernel_refs": [
    "sys/libkern/hexncpy.c:56",
    "sys/libkern/hexncpy.c:59",
    "sys/libkern/hexncpy.c:62",
    "sys/netinet/if_ether.c:632",
    "sys/netinet/if_ether.c:643",
    "sys/net/tap/if_tap.c:981",
    "sys/dev/raid/mly/mly.c:1344"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "harness_hexncpy.c", "arp_inject.c", "build.sh",
    "run.sh", "build.log", "run.log", "arp_e2e.log", "arp_e2e_fixed.log",
    "fix.diff", "fix_build.log", "fix_run.log", "env.txt", "manifest.json",
    "verdict.json"
  ]
}