⬢ DragonFlyBSD Kernel Audit
DF-2269 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
{
  "finding_id": "DF-2269",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "cd findings/poc/DF-2269 && ./build.sh  (sha256-gated verbatim scsi_cd.c harness TU, full nativekernel, installkernel, reboot)",
    "run": "./run.sh  (sysctl debug.df2269.matrix=1 / formats=1 / leak=1 / repeat=10; dmesg | grep DFH2269)",
    "expected": "unpatched: every device response with transferred<4 or resid>length-4 returns success with dvd_struct.length=0xffffffxx and a 2048-byte bcopy out of the small databuf (2044 bytes past the 8-byte MEDIUM_STAT buffer): leaked data[] contains pre-placed canary chunks and kernel heap pointers (zone free-list linkage); formats with len>=2052 report the wrapped length but stay in bounds; fixed: identical battery returns EIO on all underflow rows with zero leaked bytes, sane transfers bit-identical (fnv1a match)"
  },
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_cd.c:4288",
    "sys/bus/cam/scsi/scsi_cd.c:4289",
    "sys/bus/cam/scsi/scsi_cd.c:4295",
    "sys/bus/cam/scsi/scsi_cd.c:4297",
    "sys/bus/cam/scsi/scsi_cd.c:4207",
    "sys/bus/cam/scsi/scsi_cd.c:4208",
    "sys/bus/cam/scsi/scsi_cd.c:4122",
    "sys/bus/cam/scsi/scsi_cd.c:4226",
    "sys/bus/cam/scsi/scsi_cd.c:1006",
    "sys/bus/cam/scsi/scsi_cd.c:2751",
    "sys/bus/cam/cam_ccb.h:607",
    "sys/sys/dvdio.h:58",
    "sys/kern/sys_generic.c:668",
    "sys/kern/sys_generic.c:725",
    "sys/vfs/devfs/devfs_vnops.c:1569",
    "sys/kern/kern_device.c:237"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "df_pre.c",
    "df_post.c",
    "gen.sh",
    "build.sh",
    "quick.sh",
    "run.sh",
    "run_fixed.sh",
    "build.log",
    "build_driver.log",
    "quickkernel.log",
    "installkernel.log",
    "gen.log",
    "rig_iteration1_bootpanic.txt",
    "run_matrix.log",
    "run_formats.log",
    "run_leak.log",
    "run_repeat.log",
    "run_dmesg.log",
    "run_dmesg_full.txt",
    "run_fixed_matrix.log",
    "run_fixed_formats.log",
    "run_fixed_leak.log",
    "run_fixed_repeat.log",
    "run_fixed_dmesg.log",
    "run_fixed_currentboot.txt",
    "leak_sample_boot1.txt",
    "leak_sample_boot2.txt",
    "leak_boot2_summary.txt",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}