⬢ DragonFlyBSD Kernel Audit
DF-2462 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
{
  "finding_id": "DF-2462",
  "title": "ism_stop frees session while CAM/ic_action and sysctl handlers can still dereference it (UAF)",
  "target": "sys/dev/disk/iscsi/initiator/isc_sm.c:724-777 (victims: isc_cam.c:201-309, isc_sm.c:630-676)",
  "verdict": "reproduced",
  "impact": "leak",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "fixed_ab": "./make_fixed.sh && ./run_fixed.sh",
    "expected": "S2 cpi.max_lun=0x51515150 (attacker value read from freed chunk); S3 planted 0x50..-0x6a.. values in the sysctl output; S4 three writes into the freed chunk; S5 Fatal trap 12 at scsi_encap+0x445 (guest dies); S6 uid-1001 reads succeed in-window; fixed kernel: S0 bit-identical, S1 CAM_DEV_NOT_THERE, S2/S3/S4 live values + drain holds teardown, S5 guest survives"
  },
  "kernel_refs": [
    "sys/dev/disk/iscsi/initiator/isc_sm.c:724",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:734",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:740",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:752",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:765",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:771",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:772",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:774",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:777",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:630",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:642",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:656",
    "sys/dev/disk/iscsi/initiator/isc_cam.c:202",
    "sys/dev/disk/iscsi/initiator/isc_cam.c:211",
    "sys/dev/disk/iscsi/initiator/isc_cam.c:215",
    "sys/dev/disk/iscsi/initiator/isc_cam.c:254",
    "sys/dev/disk/iscsi/initiator/isc_cam.c:281",
    "sys/dev/disk/iscsi/initiator/isc_cam.c:57",
    "sys/dev/disk/iscsi/initiator/iscsi_subr.c:442",
    "sys/dev/disk/iscsi/initiator/iscsi.c:176",
    "sys/dev/disk/iscsi/initiator/iscsi.c:851"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df_pre.c", "df_post.c", "gen.sh",
    "build.sh", "run.sh", "make_fixed.sh", "run_fixed.sh", "fix.diff",
    "build.log", "installkernel.log", "gen.log",
    "run.log", "run.s7.log", "run.s5.log",
    "panic.txt", "panic.s5.fresh.txt", "leak_sample.txt",
    "fixed_gate.log", "fix_build.log", "fix_installkernel.log",
    "gen_fixed.log", "run_fixed.log", "run_fixed_s5.log",
    "run_fixed_s7.log", "s6_fixed_read.log", "serial_fixed_debug.txt",
    "env.txt", "verdict.json", "manifest.json"
  ]
}