⬢ DragonFlyBSD Kernel Audit
DF-2721 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
 "finding_id": "DF-2721",
 "title": "Lost-wakeup race in slab remote-free interlock permanently strands zones (kernel KVA+wired-page leak, unbounded local DoS)",
 "verdict": "reproduced (injected) / natural-rate-bounded; fix validated verbatim",
 "impact": "dos",
 "reproduce": {
  "build": "guest: cd ~/slabstrand && make ; kernel variants per VERDICT.md",
  "run": "kldload /tmp/slabstrand.ko; sysctl -w debug.slab_strand_inject=50; sysctl -n kern.slabstrand.krun=60 (x6); sysctl kern.slabstrand.census",
  "expected": "stock protocol: kmalloc_kva_kb +50-80MB/min monotonic, retained after drain+settle; fixed: flat"
 },
 "kernel_refs": [
  "sys/kern/kern_slaballoc.c:1511",
  "sys/kern/kern_slaballoc.c:1517",
  "sys/kern/kern_slaballoc.c:1539",
  "sys/kern/kern_slaballoc.c:991",
  "sys/kern/kern_slaballoc.c:1000",
  "sys/kern/kern_slaballoc.c:1337",
  "sys/kern/kern_slaballoc.c:1602",
  "sys/kern/kern_slaballoc.c:1627"
 ],
 "artifacts": [
  "slabstrand.c",
  "hammer.c",
  "build.sh",
  "run.sh",
  "build.log",
  "run.log",
  "campaigns_raw.log",
  "fix_validation.log",
  "env_kernel1.txt",
  "kernel_instrumented.c",
  "kernel_fixed.c",
  "fix.diff",
  "panic_pocbug_iteration.txt",
  "VERDICT.md",
  "manifest.json",
  "verdict.json"
 ]
}