⬢ DragonFlyBSD Kernel Audit
DF-2423 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
{
  "finding_id": "DF-2423",
  "artifact_dir": "findings/poc/DF-2423",
  "verdict": {
    "status": "reproduced",
    "reproduced": 1,
    "impact": "panic",
    "confidence": "certain",
    "summary": "Verbatim-TU kernel-compiled harness: real ahci_pm_read/ahci_pm_write NULL-deref xa->fis (offset 0, fault VA 0x0) when the per-port CCB pool is exhausted; both cited lines panic; fix.diff NULL-check returns EBUSY, control path bit-identical."
  },
  "reproduce": {
    "build": "push dfx2423.c + build.sh to guest /tmp; sh /tmp/build.sh (kernel build, sha256-gated verbatim TU include); shutdown -r now",
    "run": "sysctl hw.dfx2423_phase=1 (control), =2 (exhausted read panic), reboot, =3 (exhausted write panic); fixed: patch -p1 fix.diff in /usr/src, rebuild, rerun 1..3",
    "expected": "phase1: rv=0 data=ddccbbaa, FIS dumps, counters 2/2/2/2, guest up; phase2: Fatal trap 12 fault VA 0x0 dfx_pm_read+0x2b (ahci_pm.c:978); phase3: dfx_pm_write+0x2c (ahci_pm.c:1015); fixed: phases 2/3 return EBUSY(16), no crash"
  },
  "kernel_refs": [
    "sys/dev/disk/ahci/ahci_pm.c:976",
    "sys/dev/disk/ahci/ahci_pm.c:978",
    "sys/dev/disk/ahci/ahci_pm.c:1013",
    "sys/dev/disk/ahci/ahci_pm.c:1015",
    "sys/dev/disk/ahci/ahci.c:3669",
    "sys/dev/disk/ahci/ahci.c:3675",
    "sys/dev/disk/ahci/ahci.c:3297",
    "sys/dev/disk/ahci/ahci.c:841",
    "sys/dev/disk/ahci/ahci.c:891",
    "sys/dev/disk/ahci/atascsi.h:356",
    "sys/dev/disk/ahci/ahci_attach.c:349"
  ],
  "artifacts": [
    "dfx2423.c",
    "build.sh",
    "build.log",
    "build.fixed.log",
    "run.log", "run.sh",
    "run.control.log",
    "serial.phase2.log",
    "panic.txt",
    "serial.phase3.log",
    "panic.write.txt",
    "run.fixed.log",
    "disas.baseline-vs-fixed.txt",
    "fix.diff",
    "env.txt",
    "VERDICT.md",
    "manifest.json",
    "verdict.json"
  ],
  "poc_hashes": {
    "dfx2423.c_sha256": "8c3f8d929393b117274cfbb5762fd1511ae38968ac7e3ab72ddd0724f4aad38e",
    "ahci_pm.c_baseline_sha256": "db2f57847144879bb89c13869476e95c643ff832be6c7f13ea963ba0f2bbac66",
    "ahci_pm.c_fixed_sha256": "8a42cfdb25441c8c619daced4f029c8fe60dddc244a8179194413d05163a987f",
    "fix.diff_sha256": "769a394a7b6308c8133285e886703f5fdd3c89fe6ec76af7421d4a9e6677bed3"
  }
}