DragonFlyBSD Kernel Audit
DF-2691 / fix_validation.log
← back to finding ↓ download raw
fix_validation.log - DF-2691: exact PoC re-run on the FIXED kernel
(DragonFly 6.5-DEVELOPMENT #1, built from sys/ with findings/poc/DF-2691/fix.diff)

setup: sysctl kern.ps_arg_cache_limit=8192 (same as baseline)
command: for i in 1 2 3 4 5; do su -l t1 -c /tmp/t1home/kqsig_uaf; done

=== patched run 1 ===
[64 dangling sig-knotes attached to freed procs]
[400 p_args spray children released, argv=1251 bytes]
closing kqueue...
SURVIVED: no panic this run (re-run)
=== patched run 2 ===
[64 dangling sig-knotes attached to freed procs]
[400 p_args spray children released, argv=1251 bytes]
closing kqueue...
SURVIVED: no panic this run (re-run)
=== patched run 3 ===
[64 dangling sig-knotes attached to freed procs]
[400 p_args spray children released, argv=1251 bytes]
closing kqueue...
SURVIVED: no panic this run (re-run)
=== patched run 4 ===
[64 dangling sig-knotes attached to freed procs]
[400 p_args spray children released, argv=1251 bytes]
closing kqueue...
SURVIVED: no panic this run (re-run)
=== patched run 5 ===
[64 dangling sig-knotes attached to freed procs]
[400 p_args spray children released, argv=1251 bytes]
closing kqueue...
SURVIVED: no panic this run (re-run)
ALL_RUNS_DONE

(baseline on stock kernel: panicked on the first run, twice - run.log / run.2.log)

functionality check on the fixed kernel (EVFILT_SIGNAL must still deliver):
  kevent n=1 ident=30 data=1
  FUNC_OK