⬢ DragonFlyBSD Kernel Audit
DF-2658 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
{
  "finding_id": "DF-2658",
  "title": "hammer2_sync_replace() no-op resize: kernel OOB read persisted to cluster media",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "guest: cc -O2 -o scanbin scanbin.c (build.sh pushes sources)",
    "run": "guest root: sh trigger_df2658.sh  (~3 min; artifacts to /root/poc/df2658/)",
    "expected": "stock kernel: run.log shows DATA_REPLACE_SEEN; F_block_on_C.bin = [1024B focus content][4096B d2 file content][B-media-matching zeros for exactly 60416 tail bytes][4096B kernel memory past the 64KB dio buffer end - an ELF64 header is visible]; F's logical size collapses 65536->1024.  fixed kernel: no f_ab block matches B's media tail (equal_prefix=0), no cross-file d2 bytes, chain resized to 1024B."
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_synchro.c:939",
    "sys/vfs/hammer2/hammer2_synchro.c:941",
    "sys/vfs/hammer2/hammer2_synchro.c:954",
    "sys/vfs/hammer2/hammer2_synchro.c:1041",
    "sys/vfs/hammer2/hammer2_synchro.c:1049",
    "sys/vfs/hammer2/hammer2_chain.c:97",
    "sys/vfs/hammer2/hammer2_chain.c:1363",
    "sys/vfs/hammer2/hammer2_io.c:113",
    "sys/vfs/hammer2/hammer2.h:1963"
  ],
  "artifacts": [
    "VERDICT.md",
    "README.md",
    "trigger_df2658.sh",
    "scanbin.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "run_fixed.log",
    "fix_run.log",
    "F_block_on_C.bin",
    "F_block_on_B.bin",
    "F_tail_on_C.bin",
    "F_tail_on_B.bin",
    "f_ab.bin",
    "f_c.bin",
    "d1.bin",
    "d2.bin",
    "find_B_fab.txt",
    "find_C_fab.txt",
    "find_B_d1.txt",
    "find_B_d2.txt",
    "findfix_C_fab.txt",
    "findfix_B_fab.txt",
    "findfix_C_fc.txt",
    "cand_29372416.bin",
    "cand_29425664.bin",
    "cand_29491200.bin",
    "Btail.bin",
    "panic2.nomount-sync.txt",
    "panic3.backtrace.txt",
    "panic_fixed_kernel_siblingcrash.txt",
    "fix.diff",
    "fix_build.log",
    "env.txt",
    "manifest.json",
    "verdict.json"
  ]
}