⬢ DragonFlyBSD Kernel Audit
DF-2952 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-2952",
  "title": "Resident-exec stack remap silently fails (vm_map_stack KERN_NO_SPACE swallowed): every exec of a registered binary runs on the registration snapshot's COW stack, disclosing the registering root process's stack contents to unprivileged exec'ers",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O0 -o /tmp/df2952/victim /tmp/df2952/victim.c",
    "run": "as root: resident -f /tmp/df2952/victim with DF2952_SECRET_* marker env; then: su -m nobody -c 'env -i /tmp/df2952/victim leakcheck'",
    "expected": "leakcheck: hits above SP: 14, below SP: 7589, total 7603 / RESULT: LEAK - registration-time (root) stack data readable by uid 65534 (exit 42); control after resident -R: 0 hits"
  },
  "kernel_refs": [
    "sys/kern/imgact_resident.c:185",
    "sys/kern/imgact_resident.c:236",
    "sys/kern/kern_exec.c:949",
    "sys/kern/kern_exec.c:956",
    "sys/kern/kern_exec.c:959",
    "sys/kern/kern_exec.c:991",
    "sys/vm/vm_map.c:4001",
    "sys/vm/vm_map.c:4042",
    "sys/vm/vm_map.c:3725",
    "sys/vm/vm_map.c:3865",
    "sys/vm/vm_map.c:4298",
    "sys/vm/vm_map.c:1546",
    "sys/platform/pc64/include/vmparam.h:142",
    "libexec/rtld-elf/rtld.c:675",
    "usr.sbin/resident/resident.c:148"
  ],
  "artifacts": [
    "victim.c", "run_poc.sh", "iter.sh", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "iter.log", "run.oneshot.log",
    "fix_run.log", "fix_build.log", "fix.diff", "env.txt",
    "VERDICT.md", "manifest.json", "verdict.json"
  ]
}