⬢ DragonFlyBSD Kernel Audit
DF-3167 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
 "finding_id": "DF-3167",
 "verdict": "reproduced",
 "impact": "panic",
 "confidence": "certain",
 "reproduce": {
  "build": "cc -O2 -Wall -o /tmp/patch_leaf /tmp/patch_leaf.c   (in-guest; see build.sh/build.log)",
  "run": "sh mkimage.sh && /tmp/patch_leaf /build/poc.img && sh trigger.sh   (in-guest as root; see run.sh)",
  "expected": "stock kernel: Fatal trap 12 supervisor-write page fault in memmove+0x10a (bcopy at hammer_reblock.c:487), guest dead at db>. fixed kernel: 'HAMMER: reblock .../65536: illegal data range', ioctl returns EINVAL, guest stays up."
 },
 "kernel_refs": [
  "sys/vfs/hammer/hammer_reblock.c:487",
  "sys/vfs/hammer/hammer_reblock.c:464",
  "sys/vfs/hammer/hammer_reblock.c:467",
  "sys/vfs/hammer/hammer_btree.c:736",
  "sys/vfs/hammer/hammer_ondisk.c:1634",
  "sys/vfs/hammer/hammer_ondisk.c:1116",
  "sys/vfs/hammer/hammer_blockmap.c:177",
  "sys/vfs/hammer/hammer_blockmap.c:372"
 ],
 "artifacts": [
  "README.md",
  "VERDICT.md",
  "mkimage.sh",
  "patch_leaf.c",
  "trigger.sh",
  "build.sh",
  "run.sh",
  "build.log",
  "run.log",
  "panic.txt",
  "fixrun.log",
  "fixrun1-overlap.log",
  "env.txt",
  "code_hashes.txt",
  "fix.diff",
  "manifest.json",
  "verdict.json"
 ]
}