⬢ DragonFlyBSD Kernel Audit
DF-2927 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
  "verdict": "reproduced",
  "impact": "leak",
  "finding": "DF-2927 — debug.dump_modinfo sysctl readable by unprivileged local users discloses kernel pointers (KVA of every TLV, kernel base, module load addrs, SSYM/ESYM, _DYNAMIC, ENVP, KERNEND)",
  "reproduce": {
    "build": "./build.sh  (no-op — trigger is stock /sbin/sysctl)",
    "run": "./run.sh   (or on-guest, unprivileged: sysctl -n debug.dump_modinfo)",
    "expected": "uid!=0 receives the full 26-TLV dump incl. 0xffffffff80200000 kernel base, SSYM/ESYM 0xffffffff81b25e40/0xffffffff81cd8538, ENVP 0x1de3000; byte-identical across runs"
  },
  "kernel_refs": [
    "sys/kern/subr_module.c:411",
    "sys/kern/subr_module.c:373-385",
    "sys/kern/subr_module.c:429-450",
    "sys/kern/kern_sysctl.c:1436-1448",
    "sys/kern/kern_sysctl.c:649"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "build.sh", "run.sh",
    "run.log", "run.2.log", "leak_sample.txt", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}