⬢ DragonFlyBSD Kernel Audit
DF-2270 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
{
  "finding_id": "DF-2270",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "cd rig && ./build.sh",
    "run": "cd rig && ./run_tests.sh && ./run_hang.sh",
    "expected": "vulnerable: ges type 8 count 300 and type 1000 count 1000 return SUCCESS (OOB-authorized); debug.dfch.hang=1 wedges the whole guest (pagedaemon continuous paging, ssh death). fixed: both EINVAL, in-range ioctls unchanged, hang trigger returns instantly."
  },
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_ch.c:1066",
    "sys/bus/cam/scsi/scsi_ch.c:1077",
    "sys/bus/cam/scsi/scsi_ch.c:1079",
    "sys/bus/cam/scsi/scsi_ch.c:1100",
    "sys/bus/cam/scsi/scsi_ch.c:1137",
    "sys/bus/cam/scsi/scsi_ch.c:1129",
    "sys/bus/cam/scsi/scsi_ch.c:805",
    "sys/bus/cam/scsi/scsi_ch.c:364",
    "sys/bus/cam/scsi/scsi_ch.c:396"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "verdict.json",
    "manifest.json",
    "fix.diff",
    "env.txt",
    "hang_iteration1.txt",
    "run_all.log",
    "run_dmesg.log",
    "run_fixed_all.log",
    "run_fixed_dmesg.log",
    "rig/hang_serial.log",
    "rig/hang_pagedaemon.log",
    "rig/df_pre.c",
    "rig/df_post.c",
    "rig/ch_user.c",
    "rig/gen.sh",
    "rig/check_verbatim.sh",
    "rig/build.sh",
    "rig/make_fix.sh",
    "rig/run_tests.sh",
    "rig/run_hang.sh",
    "rig/run_fixed.sh",
    "rig/fix2270.diff",
    "rig/fix227x_all.diff",
    "rig/build.log",
    "rig/build_user.log",
    "rig/disasm_full.txt",
    "rig/disasm_fixed.txt",
    "rig/verbatim.log",
    "build.log",
    "run.log"
  ]
}