⬢ DragonFlyBSD Kernel Audit
DF-2368 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
{
  "finding_id": "DF-2368",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "guest, as root, from this directory: sh build.sh (nativekernel build + installkernel, builds /root/rijnh); reboot",
    "run": "sh run_kat.sh (control); sh run_setkey.sh 0 (demo A panic); sh run_poison.sh poison (demo B fatal trap 12); sh run_poison.sh direct (demo B via raw rijndaelEncrypt); after each panic: vm.sh reset harness-kernel",
    "expected": "stock kernel: 16/16 KATs PASS; setkey 0 -> panic: Invalid key size (0) at rijndaelKeySetupEnc; poison/direct -> Fatal trap 12 page fault while in kernel mode at rijndaelEncrypt+0x1d9 with fault VA 0x1200 bytes past ek (4128 bytes past the ctx); with fix.diff applied: all boundary inputs rejected, poison/direct SURVIVED, 16/16 KATs bit-identical"
  },
  "kernel_refs": [
    "sys/crypto/rijndael/rijndael-alg-fst.c:734",
    "sys/crypto/rijndael/rijndael-alg-fst.c:738",
    "sys/crypto/rijndael/rijndael-alg-fst.c:814",
    "sys/crypto/rijndael/rijndael-alg-fst.c:862",
    "sys/crypto/rijndael/rijndael-alg-fst.c:951",
    "sys/crypto/rijndael/rijndael-alg-fst.c:979",
    "sys/crypto/rijndael/rijndael-api.c:37"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "rijndael_harness.c",
    "rijndael_twin_tables.h",
    "rijnh.c",
    "build.sh",
    "run_kat.sh",
    "run_setkey.sh",
    "run_poison.sh",
    "run_idx.sh",
    "build_baseline.log",
    "build_fixed.log",
    "install_baseline.log",
    "install_fixed.log",
    "kat_baseline_dmesg.txt",
    "panic.setkey0.txt",
    "panic.poison.txt",
    "panic.direct.txt",
    "fixrun_dmesg.txt",
    "idx_dmesg.txt",
    "idx_run.out",
    "idx_analysis.txt",
    "idx_analysis2.txt",
    "fix.diff",
    "env.txt",
    "ttables.txt",
    "verdict.json",
    "manifest.json"
  ]
}