DragonFlyBSD Kernel Audit
DF-2702 / manifest.json
← back to finding ↓ download raw
{
  "finding_id": "DF-2702",
  "verdict": "reproduced",
  "impact": "leak",
  "reproduce": {
    "build": "cc -O2 -Wall -o peek_rights_leak peek_rights_leak.c",
    "run": "./peek_rights_leak  (as unprivileged user; also ./dgram_peek)",
    "expected": "PEEK returns cmsg_len=32 (CMSG_LEN(2*8)) with slots 0xfffff801xxxxxxxx (raw struct file pointers), stable across peeks; REAL recv returns cmsg_len=24 with fd numbers"
  },
  "kernel_refs": [
    "sys/kern/uipc_socket.c:1421-1425",
    "sys/kern/uipc_usrreq.c:1543-1633",
    "sys/kern/uipc_usrreq.c:1817-1825",
    "sys/kern/uipc_syscalls.c:1172-1189",
    "sys/kern/uipc_syscalls.c:934-943"
  ],
  "artifacts": [
    "peek_rights_leak.c",
    "dgram_peek.c",
    "build.sh",
    "run.sh",
    "run.log",
    "run.2.log",
    "env.txt",
    "fix.diff",
    "fix_build_excerpt.txt",
    "fix_validation.log",
    "VERDICT.md",
    "manifest.json",
    "verdict.json"
  ]
}