⬢ DragonFlyBSD Kernel Audit
DF-3078 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-3078",
  "manifest_version": 1,
  "title": "ffs_reload (MNT_RELOAD) adopts re-read superblock geometry without validation — heap OOB write (controlled), div-by-zero, heap OOB read to media",
  "file": "sys/vfs/ufs/ffs_vfsops.c",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "in guest as root: cd /root/rt && sh build.sh  (cc -o craft/dumpsb/reload)",
    "run": "sh run.sh <variant>   variants: unchanged|cssize|fsize0|ncg|sbsize_leak|sbsize_fault",
    "expected": "baseline #0: fsize0 -> Fatal trap 18 idivl; ncg -> vm_fault stack-guard panic; sbsize_fault -> trap 12 supervisor-read in memmove; cssize -> reload RETURNS 0 with ~522KB heap smash (silent); sbsize_leak -> bytes past um_fs on the media. patched #1 (fix.diff): every crafted variant -> 'mount: Invalid argument', guest stays up; unchanged reload + RW mounts still work."
  },
  "kernel_refs": [
    "sys/vfs/ufs/ffs_vfsops.c:479",
    "sys/vfs/ufs/ffs_vfsops.c:484",
    "sys/vfs/ufs/ffs_vfsops.c:493",
    "sys/vfs/ufs/ffs_vfsops.c:495",
    "sys/vfs/ufs/ffs_vfsops.c:500",
    "sys/vfs/ufs/ffs_vfsops.c:504",
    "sys/vfs/ufs/ffs_vfsops.c:515",
    "sys/vfs/ufs/ffs_vfsops.c:517",
    "sys/vfs/ufs/ffs_vfsops.c:521",
    "sys/vfs/ufs/ffs_vfsops.c:526",
    "sys/vfs/ufs/ffs_vfsops.c:533",
    "sys/vfs/ufs/ffs_vfsops.c:536",
    "sys/vfs/ufs/ffs_vfsops.c:671",
    "sys/vfs/ufs/ffs_vfsops.c:680",
    "sys/vfs/ufs/ffs_vfsops.c:1292",
    "sys/vfs/ufs/ffs_vfsops.c:1295"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "reload.c", "craft.c", "dumpsb.c", "setup.sh",
    "build.sh", "run.sh", "build.log", "run.log", "run.patched.log",
    "panic_idivl_fsize0.txt", "panic_maxcluster_ncg.txt",
    "panic_sbupdate_oob_read.txt", "env.txt", "fix.diff", "manifest.json",
    "verdict.json"
  ]
}