⬢ DragonFlyBSD Kernel Audit
DF-2427 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "finding_id": "DF-2427",
  "reproduce": {
    "build": "cd findings/poc/DF-2426 && ./build.sh   (shared kernel-compiled verbatim harness: df_pre.c + byte-verbatim amd.c + df_post.c -> dev/disk/amd/dfamd_harness.c; register IO executes the real inline bus_space code against a fabricated AMD53c974 register block with pop-on-read SCSI FIFO)",
    "run": "cd ../DF-2427 && ./run.sh   (sysctl debug.df2427.battery=1 -> contained battery: layout dump, poison reselect OOB chain, field-alias variant, wrong-target confusion, valid control, 0 checks failed; sysctl debug.df2427.battery=2 -> scenario A2 lets the real MSG IN path dereference the non-canonical wild active_srb -> Fatal trap 12 supervisor write). A/B: ../DF-2426/make_fixed.sh && ./run_fixed.sh",
    "expected": "Baseline battery=1: cur_target=-1 from byte 0x80; active_srb loaded from softc-8 (OOB read); softc-8..-1 zeroed (OOB write); disc_count[-1][0]-- corrupts tinfo[6].goal 0x0000->0xFFFF; chip sync/C1/C3/C4 regs loaded from tinfo[-1] OOB bytes; SRB_DISCONNECT written through the wild active_srb into the victim object; battery=2 ends in Fatal trap 12: page fault, fault virtual address 0x70000016f, supervisor write, Stopped at amd_MsgInPhase0+0xae: movw %si,0x170(%rax). Fixed kernel: every poison scenario rejected (amd0: Invalid reselection ID, resetting bus), valid control still binds, 0 checks failed, no fault."
  },
  "kernel_refs": [
    "sys/dev/disk/amd/amd.c:1829",
    "sys/dev/disk/amd/amd.c:1831",
    "sys/dev/disk/amd/amd.c:1833",
    "sys/dev/disk/amd/amd.c:1834",
    "sys/dev/disk/amd/amd.c:1844",
    "sys/dev/disk/amd/amd.c:1845",
    "sys/dev/disk/amd/amd.c:1848",
    "sys/dev/disk/amd/amd.c:1218",
    "sys/dev/disk/amd/amd.h:204",
    "sys/dev/disk/amd/amd.h:207"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df_pre.c", "df_post.c", "gen.sh",
    "build.sh", "run.sh", "make_fixed.sh", "run_fixed.sh", "fix.diff",
    "build.log", "run.log", "run_battery1_clean.log",
    "run_battery1_dmesg.log", "run_battery1_dmesg.iter1.log",
    "run_battery1.log", "run_battery2.log", "panic_2427.txt",
    "run_fixed_dmesg.log", "run_fixed_battery.log",
    "fix_build.log", "fix_installkernel.log", "gen.log", "env.txt",
    "manifest.json", "verdict.json"
  ]
}