⬢ DragonFlyBSD Kernel Audit
DF-2304 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-2304",
  "title": "Double-free / UAF in fwohci_pci_add_child error path (fwohci_pci.c:446-447)",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "scp -F dfbsd-qemu/config fwohci_harness.c fwohci_harness.h fwpci_harness.c fwpci_harness.h fwpcictl.c fwpci_prep.sh build_kernel.sh dfbsd:/root/fwo/ && vm.sh run_root 'sh /root/fwo/fwpci_prep.sh && sh /root/fwo/build_kernel.sh' && vm.sh down && vm.sh up",
    "run": "vm.sh run_root 'sh /root/fwo/run2304.sh'   # guest panics; vm.sh log shows the evidence",
    "expected": "two device_delete_child log lines with the same child pointer (fwohci_pci.c:352 then :447) followed by: panic: Bad link elm 0xfffff8011769c6a0 prev->next != elm, backtrace through fwohci_pci_add_child"
  },
  "kernel_refs": [
    "sys/bus/firewire/fwohci_pci.c:446-447",
    "sys/bus/firewire/fwohci_pci.c:439",
    "sys/bus/firewire/fwohci_pci.c:351-353",
    "sys/kern/subr_bus.c:1284-1310",
    "sys/kern/subr_bus.c:2793",
    "sys/bus/firewire/firewire.c:106",
    "sys/bus/firewire/firewire.c:313-317",
    "sys/bus/firewire/firewire.c:383-416"
  ],
  "artifacts": [
    "fwpci_harness.c", "fwpci_harness.h", "fwohci_harness.c", "fwohci_harness.h",
    "fwpcictl.c", "fwpci_prep.sh", "build_kernel.sh", "build_fix.sh",
    "run2304.sh", "run.log", "panic.txt", "run_fixed.log", "fix.diff",
    "env.txt", "build.log", "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}