DragonFlyBSD Kernel Audit
DF-3055 / run.3.log
← back to finding ↓ download raw
== (1) errno clobber transcription (vnops.c:1196-1197/1070)
  real alloc_file error=2 (ENOENT), stale errno=0 -> nsymlink returns 0 (SUCCESS despite failure!)
  real alloc_file error=2 (ENOENT), stale errno=13 -> nsymlink returns 13 
  real alloc_file error=2 (ENOENT), stale errno=21 -> nsymlink returns 21 

== (2) VULNERABLE nsymlink :1194-1200
  [nsymlink-vuln] child killed by SIGSEGV -- NULL DEREF at dirfs_knote(*vpp) CONFIRMED
== (3) FIXED nsymlink (gate on error==0)
  [nsymlink-fixed] returned error=2

RESULT: errno-clobber proven; vulnerable nsymlink crashed with SIGSEGV; fixed survived => BUG CONFIRMED, FIX VALIDATED
harness exit code: 2 (2 = BUG CONFIRMED + FIX VALIDATED)