⬢ DragonFlyBSD Kernel Audit
DF-3106 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-3106",
  "verdict": "REPRODUCED",
  "impact": "kernel heap OOB write (attacker-controlled content and extent, up to tens of KB past a 512-byte buffer-cache buffer), followed by guaranteed panic",
  "confidence": "certain",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "reproduce": {
    "build": "./build.sh",
    "run": "(as root on guest) ./craft_image.sh A && ./trigger.sh A   [variant B analogously]",
    "expected": "A: panic ufs_direnter: compact2 after a 264B bcopy at dirbuf+264 in a 512B buffer (16B OOB). B: Fatal trap 12 supervisor-write page fault in memmove (bcopy ~22.7KB past the buffer). Fixed kernel: EIO, no panic."
  },
  "kernel_refs": [
    "sys/vfs/ufs/ufs_lookup.c:808",
    "sys/vfs/ufs/ufs_lookup.c:831",
    "sys/vfs/ufs/ufs_lookup.c:843",
    "sys/vfs/ufs/ufs_lookup.c:857-862",
    "sys/vfs/ufs/ufs_lookup.c:264-266",
    "sys/vfs/ufs/ufs_lookup.c:282-303",
    "sys/vfs/ufs/ufs_lookup.c:64-68",
    "sys/vfs/ufs/dir.h:113-122",
    "sys/vfs/ufs/ufs_vnops.c:762"
  ],
  "fix": "validated (kernel #1: EIO, no panic; regression clean)",
  "artifacts": [
    "patch_dir.c", "craft_image.sh", "trigger.sh", "build.sh",
    "build.log", "env.txt",
    "runA.log", "panicA.txt", "runB.log", "panicB.txt",
    "runA.patched.log", "runB.patched.log",
    "fix.diff", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}