⬢ DragonFlyBSD Kernel Audit
DF-2613 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
{
  "finding_id": "DF-2613",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "CODE-CONFIRMED, LIVE-UNREACHABLE (missing_setup): the off-by-one is certain from source — the three config-page walkers guard buffer[off+3] reads with 'if (off + 3 > amt)' (ses_enchdr scsi_ses.c:1312/1316, ses_encdesc :1330/1334, ses_getthdr :1359/1363), which admits off+3 == amt and then reads buffer[amt] at :1314/:1321, :1332/:1337, :1366. In ses_getconfig the buffer is an exact kmalloc(SCSZ=8192) (:1086, SES_MALLOC=:127, SCSZ=:937) and amt = SCSZ - resid can equal 8192 when the device transfers the full page (ses_runcmd sets *dlenp = ccb->csio.resid at :695; :1090-1096), so a crafted VEnclen chain landing on off == 8189 reads sdata[8192], one byte past the heap allocation, at first open of the root-gated /dev/sesN (sesopen :428-433 -> softc_init -> ses_getconfig :988). The mis-read byte only feeds a skip length that is re-bounded by the following checks (:1339, :1342-1345, :1367) and never reaches userspace — defense-in-depth, exactly as filed. Live reproduction requires an SES target returning a maximal crafted Configuration Page: the QEMU guest has no SES device (camcontrol devlist shows only a QEMU DVD-ROM, /dev/sesN absent) and none can be attached, so no runtime observation (a guard-page/KMALLOC_GUARD kernel would additionally be needed to observe the touch). The 6-predicate bounds fix is mechanical and verified to apply.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-2613/VERDICT.md — line-precise walker trace incl. allocation size, resid semantics, and why the byte cannot propagate",
    "findings/poc/DF-2613/env.txt — guest inventory proving the missing-setup blocker",
    "findings/poc/DF-2613/fix.diff — off+3>amt -> off+4>amt in all three walkers (6 predicates), dry-run verified"
  ],
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_ses.c:1311",
    "sys/bus/cam/scsi/scsi_ses.c:1314",
    "sys/bus/cam/scsi/scsi_ses.c:1316",
    "sys/bus/cam/scsi/scsi_ses.c:1321",
    "sys/bus/cam/scsi/scsi_ses.c:1330",
    "sys/bus/cam/scsi/scsi_ses.c:1334",
    "sys/bus/cam/scsi/scsi_ses.c:1359",
    "sys/bus/cam/scsi/scsi_ses.c:1363",
    "sys/bus/cam/scsi/scsi_ses.c:1366",
    "sys/bus/cam/scsi/scsi_ses.c:1086",
    "sys/bus/cam/scsi/scsi_ses.c:695"
  ],
  "poc_changes": "verify mode, no seed: no PoC was runnable — an availability-check script (check_env.sh) documents the blocker",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 600,
  "guest_dirty": 0,
  "build_cmd": "n/a (no SES device; see check_env.sh)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root 'sh findings/poc/DF-2613/check_env.sh'  # exits 1: no /dev/sesN",
  "code_hash": "91899e29a3be41ae29a4a76cc35d1fa323166700d92a2db61265cc3f5037e0c9",
  "notes": "missing_setup blocker identical to DF-2612. fix_status=not_testable. The tightened predicates only reject the previously-admitted off+3==amt edge, so no legitimate Configuration Page is newly rejected (predicate style already used at :1367 and in ses_decode:1454/ses_encode:1526).",
  "recommended_fix": "change the six walker predicates from 'off + 3 > amt' to 'off + 4 > amt' in ses_enchdr/ses_encdesc/ses_getthdr (scsi_ses.c:1312,1316,1330,1334,1359,1363)",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applies cleanly (patch -p1 dry-run against pristine sys/) and is provably tightening-only; cannot be behavior-validated without an SES target presenting a maximal crafted page",
  "fix_evidence": "findings/poc/DF-2613/fix.diff"
}