DF-2702 / manifest.json
{ "finding_id": "DF-2702", "verdict": "reproduced", "impact": "leak", "reproduce": { "build": "cc -O2 -Wall -o peek_rights_leak peek_rights_leak.c", "run": "./peek_rights_leak (as unprivileged user; also ./dgram_peek)", "expected": "PEEK returns cmsg_len=32 (CMSG_LEN(2*8)) with slots 0xfffff801xxxxxxxx (raw struct file pointers), stable across peeks; REAL recv returns cmsg_len=24 with fd numbers" }, "kernel_refs": [ "sys/kern/uipc_socket.c:1421-1425", "sys/kern/uipc_usrreq.c:1543-1633", "sys/kern/uipc_usrreq.c:1817-1825", "sys/kern/uipc_syscalls.c:1172-1189", "sys/kern/uipc_syscalls.c:934-943" ], "artifacts": [ "peek_rights_leak.c", "dgram_peek.c", "build.sh", "run.sh", "run.log", "run.2.log", "env.txt", "fix.diff", "fix_build_excerpt.txt", "fix_validation.log", "VERDICT.md", "manifest.json", "verdict.json" ] } |