⬢ DragonFlyBSD Kernel Audit
DF-3203 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
{
  "finding_id": "DF-3203",
  "verdict": "reproduced",
  "impact": "leak",
  "reproduce": {
    "build": "sh build.sh  (sha256 verbatim gate + make -j6 nativekernel KERNCONF=X86_64_GENERIC + make installkernel; reboot)",
    "run": "sh attrib.sh  (userland primer attribution: 2 patterns x 3 rounds x 3 attempts, usched :1 pinned)  ;  sh run.sh  (kernel-groom canaries 0xc3/0x5a + groom32(2) coupling + leak samples)  ;  fix A/B: build fixed kernel per DF-3205/build.sh with the fixed sha, reboot, sh run_fixed.sh (DF-3205 pack)",
    "expected": "baseline: verbatim console lines rpc denied, status=1515870810 for primer 0x5a5a5a5a (9/9) and status=1019428035 for primer 0x3cc33cc3 (9/9), a 0xc3 groom hit (-1010580541), varying residue values (943337777 = ASCII 8:11, 153789694, ...), ENOBUFS aborts when stale==0, EBADRPC + exactly +3 leaked mbufs when the primer plants 0x00000002; fixed kernel: zero rpc denied lines from short replies, calls complete on the honest follow-up"
  },
  "kernel_refs": [
    "sys/vfs/nfs/krpc_subr.c:356-357",
    "sys/vfs/nfs/krpc_subr.c:366",
    "sys/vfs/nfs/krpc_subr.c:370-373",
    "sys/vfs/nfs/krpc_subr.c:384",
    "sys/vfs/nfs/krpc_subr.c:391",
    "sys/vfs/nfs/krpc_subr.c:397",
    "sys/vfs/nfs/krpc_subr.c:417-419",
    "sys/sys/sockbuf.h:115-126",
    "sys/kern/uipc_socket.c:1277"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "dfrig13_krpc.c",
    "attacker.c",
    "build.sh",
    "run.sh",
    "attrib.sh",
    "run.log",
    "run.2.log",
    "run.attrib.log",
    "run.couple.log",
    "couple.log",
    "run.fixed.log",
    "canary_dump.txt",
    "leak_sample.txt",
    "primer_leak_sample.txt",
    "short_c3.log",
    "short_5a.log",
    "short_g2.log",
    "short_p_5a5a5a5a_1.log",
    "short_p_5a5a5a5a_2.log",
    "short_p_5a5a5a5a_3.log",
    "short_p_3cc33cc3_1.log",
    "short_p_3cc33cc3_2.log",
    "short_p_3cc33cc3_3.log",
    "build_summary.log",
    "fix.diff",
    "fix_all.diff",
    "env.txt",
    "manifest.json",
    "verdict.json",
    "run_fixed.sh"
  ]
}