⬢ DragonFlyBSD Kernel Audit
DF-2716 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "finding_id": "DF-2716",
  "title": "nlookup() trailing-slash drops NLC_STICKY/NLC_APPENDONLY dflags — sticky-bit and append-only directory deletion bypass",
  "verdict": "reproduced",
  "impact": "authorization-bypass (sticky/sappnd), unprivileged",
  "reproduce": {
    "build": "cc -O0 -g -o /tmp/df2716_bin/df2716 df2716.c",
    "run": "sh run.sh /df2716h   (as root on the guest; arg = base dir, e.g. /df2716h hammer2 or /tmp tmpfs)",
    "expected": "stock kernel: a2 rmdir victim/ = 0, a4 rename victim/ = 0, b2 rmdir sappnd-sub/ = 0 (hammer2); controls a1/a3/b1 denied. patched kernel: all PoC phases denied."
  },
  "kernel_refs": [
    "sys/kern/vfs_nlookup.c:653-660",
    "sys/kern/vfs_nlookup.c:678",
    "sys/kern/vfs_nlookup.c:1213-1215",
    "sys/kern/vfs_nlookup.c:1704-1711",
    "sys/kern/vfs_nlookup.c:1838-1842",
    "sys/kern/vfs_nlookup.c:1902-1905",
    "sys/vfs/ufs/ufs_vnops.c:1483",
    "sys/vfs/tmpfs/tmpfs_vnops.c:1132"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df2716.c", "run.sh", "build.sh", "fix.diff",
    "build.log", "run.log", "run.hammer2.log", "run.baseline.log",
    "run.fixed.log", "kbuild.tail.log", "env.txt", "manifest.json",
    "verdict.json"
  ]
}