⬢ DragonFlyBSD Kernel Audit
DF-3083 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
{
  "finding_id": "DF-3083",
  "title": "ext2_dirbad panics a writable-mounted ext2 on any mangled dirent (crafted-image local DoS)",
  "impact": "panic",
  "verdict": "reproduced / fix validated",
  "reproduce": {
    "build": "host: cd findings/poc/DF-3083 && python3 craft.py /tmp/e2work; guest: scp mangle.img vntool.c to /root; cc -O2 -o /root/vntool /root/vntool.c",
    "run": "guest root: sh run.sh",
    "expected": "stock kernel: RO section completes; RW section panics 'ext2_dirbad: /mnt/e2: bad dir ino 12 at offset 56: mangled entry'; patched kernel: RW mount survives, ENOENT, console ext2_dirbad printf"
  },
  "kernel_refs": [
    "sys/vfs/ext2fs/ext2_lookup.c:701",
    "sys/vfs/ext2fs/ext2_lookup.c:771-784",
    "sys/vfs/ext2fs/ext2_lookup.c:794-819"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "craft.py", "run.sh", "fix_run.sh",
    "fix.diff", "run.log", "panic.txt", "fix_run.log",
    "verdict.json", "manifest.json", "env.txt"
  ]
}