⬢ DragonFlyBSD Kernel Audit
DF-2763 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
{
  "finding_id": "DF-2763",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "journal_mountctls attach/detach lifecycle state machine is lock-free; two concurrent mountctl ops interleave it so journal_detach runs twice (or straddles journal_destroys tsleep), firing KKASSERT(mnt_jbitmap != NULL) at vfs_jops.c:248 (reproduced 3/3, incl. a writers-free minimal config); on release kernels the interleave is a double kfree of the 1024-byte M_JOURNAL bitmap and, vs in-flight jreclists, a UAF bit-RMW at :547/:556/:613. Root-gated (mountctl = SYSCAP_RESTRICTEDROOT) so privesc is not the model; impact is kernel panic / slab corruption.",
  "exploit_chain": "",
  "evidence": [
    "panic.txt (3 captures, all :248 via sys_mountctl)",
    "console_run4_full.log (minimal 2-loop config, no VOP traffic)",
    "VERDICT.md fix section: baseline panic vs patched clean completion (85+85 cycles)"
  ],
  "kernel_refs": [
    "sys/kern/vfs_jops.c:162",
    "sys/kern/vfs_jops.c:185",
    "sys/kern/vfs_jops.c:245-253",
    "sys/kern/vfs_jops.c:547",
    "sys/kern/vfs_jops.c:556",
    "sys/kern/vfs_jops.c:613",
    "sys/kern/vfs_syscalls.c:1037"
  ],
  "poc_changes": "no seed existed; authored from scratch: two concurrent mountctl -a/-d churn loops proved sufficient (writers unnecessary)",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline); fixed kernel #2 Mon Aug 31 23:12:27 UTC 2026",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "make -j6 nativekernel KERNCONF=X86_64_GENERIC (fix)",
  "run_cmd": "sh run.sh (two concurrent mountctl install/remove churn loops on /tmp, 90 s)",
  "code_hash": "d385af86622a8d0f7d4be05a00f010baf5746a0ce22b2799585d762eed0d1031",
  "notes": "fix v1 (token-only) FAILED - tokens drop across tsleep; v2 adds idempotent detach + tokened bitmap RMW sections; see fixrun_v1_console.log and VERDICT.md. Related family: DF-2704 (vop-vector), DF-2747 (memfifo), DF-2748 (jo free; its drain-wedge also re-appeared in an intermediate run and is attributed there, not here).",
  "recommended_fix": "Serialize journal_mountctl with mnt_token, make journal_detach idempotent (NULL-guard), token-protect jreclist_init/done bitmap RMW (fix.diff)",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #2: Mon Aug 31 23:12:27 UTC 2026",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "exact PoC config re-run on patched kernel #2: 85+85 churn cycles completed, no panic, guest up, M_JOURNAL in-use back to 0 (baseline: panic <=90 s, 3/3)",
  "fix_evidence": [
    "fix.diff",
    "fixrun_v1_console.log (failed v1, kept honest)",
    "fix_build_v2.log tail in task log: RC=0 INST=0"
  ]
}