⬢ DragonFlyBSD Kernel Audit
DF-2326 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-2326",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "NOT REPRODUCED LIVE -- hardware-gated: the free side of the race does not exist on this guest. Source defect fully confirmed: pci_token is file-static (pci_user.c:59) and its only takers in the whole tree are pci_ioctl (pci_user.c:332 gettoken / :753 reltoken) -- nm on the running kernel shows it as local d -- while pci_freecfg (pci.c:2139-2162) STAILQ_REMOVEs + kfrees pci_devinfo with no lock at all, and the PCIOCGETCONF walk (:463-553) dereferences dinfo->cfg.dev (:474), dinfo->conf fields and copyouts them. /dev/pci is 0644 (world-readable) and GETCONF needs no FWRITE, so the traversal side is unprivileged. But pci_freecfg is reachable only from CardBus hot-unplug (sys/dev/pccard/cardbus/cardbus.c:191,246) and this QEMU guest has zero CardBus bridges (pciconf: no class 0607), so the UAF cannot be triggered here by any actor. On CardBus-capable hardware the window is wide (full-list walk with per-entry copyout vs constant-time free).",
  "exploit_chain": "",
  "evidence": "VERDICT.md + env.txt: static token single-taker proof (source grep + nm local symbol), pci_freecfg caller census, /dev/pci 0644 perms, pciconf CardBus census (0)",
  "kernel_refs": [
    "sys/bus/pci/pci_user.c:59",
    "sys/bus/pci/pci_user.c:332",
    "sys/bus/pci/pci_user.c:463",
    "sys/bus/pci/pci_user.c:474",
    "sys/bus/pci/pci_user.c:548",
    "sys/bus/pci/pci_user.c:753",
    "sys/bus/pci/pci.c:2139",
    "sys/dev/pccard/cardbus/cardbus.c:191",
    "sys/dev/pccard/cardbus/cardbus.c:246"
  ],
  "poc_changes": "No PoC possible on this guest; static verification pack only (env.txt captures the running-kernel facts).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Wed Oct 21 11:04:42 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/BUSAUDIT x86_64 (stock GENERIC + device targ; INVARIANTS)",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Recommend the token (or a real lock) around pci_devq mutations per the fix sketch in VERDICT.md.",
  "recommended_fix": "Serialize pci_devq mutations with the same token the ioctl uses (fix sketch in VERDICT.md: lwkt_gettoken around STAILQ_REMOVE/INSERT in pci_freecfg and pci_add_device).",
  "fix_status": "not_testable",
  "fix_validation": "not triggerable on this guest even unfixed (no CardBus controller); A/B vacuous"
}