DragonFlyBSD Kernel Audit
DF-2543 / leak_sample.txt
← back to finding ↓ download raw
## DF-2543 leak sample (3 runs, byte-identical => stable kernel addrs)
## device_t kernel pointers from hw.bus.devices, all in 0xfffff800 (canonical KVA)
## stride 0xa0 (160 bytes) reveals device_t slab layout

[  0] handle=0xfffff8008bb7f6c0* parent=0x0000000000000000   root0           
[  1] handle=0xfffff8008bb7f800* parent=0xfffff8008bb7f6c0*  nexus0          
[  2] handle=0xfffff8008bb7f8a0* parent=0xfffff8008bb7f800*  acpi0           
[  3] handle=0xfffff8008bb7f940* parent=0xfffff8008bb7f800*  rdrand0         
[  4] handle=0xfffff8008bb7f9e0* parent=0xfffff8008bb7f800*  ram0            
[  5] handle=0xfffff8008bb7fa80* parent=0xfffff8008bb7f800*  legacy0         
[  6] handle=0xfffff8008bb7fb20* parent=0xfffff8008bb7f800*  sc0             
[  7] handle=0xfffff8008bb7fc60* parent=0xfffff8008bb7f8a0*  pcib0           
[  8] handle=0xfffff8008bb7fd00* parent=0xfffff8008bb7f8a0*                  
[  9] handle=0xfffff8008bb7fda0* parent=0xfffff8008bb7f8a0*                  
[ 10] handle=0xfffff8008bb7fe40* parent=0xfffff8008bb7f8a0*                  
[ 11] handle=0xfffff8008bb7fee0* parent=0xfffff8008bb7f8a0*                  

## summary across 3 runs:
run.log: devices enumerated : 110
run.log: leaked dv_handle   : 110  (raw device_t kernel pointers)
run.log: leaked dv_parent   : 109  (raw parent device_t kernel pointers)
run.log: RESULT: LEAK CONFIRMED -- 219 raw kernel pointers disclosed (KASLR defeated)
run.2.log: devices enumerated : 110
run.2.log: leaked dv_handle   : 110  (raw device_t kernel pointers)
run.2.log: leaked dv_parent   : 109  (raw parent device_t kernel pointers)
run.2.log: RESULT: LEAK CONFIRMED -- 219 raw kernel pointers disclosed (KASLR defeated)
run.3.log: devices enumerated : 110
run.3.log: leaked dv_handle   : 110  (raw device_t kernel pointers)
run.3.log: leaked dv_parent   : 109  (raw parent device_t kernel pointers)
run.3.log: RESULT: LEAK CONFIRMED -- 219 raw kernel pointers disclosed (KASLR defeated)