⬢ DragonFlyBSD Kernel Audit
DF-2835 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{
  "finding_id": "DF-2835",
  "verdict": "reproduced",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "scp -F dfbsd-qemu/config findings/poc/DF-2835/vmsp_abi.c dfbsd:/tmp/ && dfbsd-qemu/vm.sh run_root 'cc -O2 -Wall -o /tmp/vmsp_abi /tmp/vmsp_abi.c'",
    "run": "dfbsd-qemu/vm.sh run_root 'sysctl vm.vkernel_enable=1' && dfbsd-qemu/vm.sh run_user '/tmp/vmsp_abi; echo EXIT=$?' && dfbsd-qemu/vm.sh run_root 'sysctl vm.vkernel_enable=0'",
    "expected": "stock kernel: create(id=NULL) rc=0, second NULL create EEXIST, create(type=123,data=0xdead0000) rc=0, exit 0 (BUG REPRODUCED); fixed kernel: both EINVAL, legit create rc=0, exit 1 (contract enforced)"
  },
  "kernel_refs": [
    "sys/vm/vm_vmspace.c:134-139",
    "sys/vm/vm_vmspace.c:146-201",
    "sys/vm/vm_vmspace.c:155-156",
    "sys/vm/vm_vmspace.c:184",
    "sys/vm/vm_vmspace.c:190",
    "sys/vm/vm_vmspace.c:581-589"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "vmsp_abi.c",
    "build.sh", "run.sh", "build.log", "run.log", "run.fixed.log",
    "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}