⬢ DragonFlyBSD Kernel Audit
DF-3205 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{
  "finding_id": "DF-3205",
  "verdict": "reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "sh build.sh  (sha256 verbatim gate on sys/vfs/nfs/krpc_subr.c + make -j6 nativekernel KERNCONF=X86_64_GENERIC + make installkernel; reboot)",
    "run": "sh blindboot.sh  (FIRST rig activity after a fresh boot: blind predicted-xid portmap spoof)  ;  sh run.sh  (determinism dump + wrong-origin acceptance + portmap end-to-end)  ;  fix A/B: sh build.sh af834f6e30225b1af68cc83cbcdaf25e29e0e39ca6deaec6f3c13663a661b886 ; reboot ; sh run_fixed.sh",
    "expected": "baseline: first-call xid 0xffffff00 MATCH blind prediction, krpc_portmap err=0 port bytes ca fe (attacker-chosen), sequential calls carry 0xffffff01..06 from client port 1023 every time, reply from 127.0.0.2 accepted (payload ATTA); fixed kernel: xids random (blind predictions differ), wrong-origin reply dropped (payload SERV), blind portmap spoof rejected (port bytes 77 77)"
  },
  "kernel_refs": [
    "sys/vfs/nfs/krpc_subr.c:201",
    "sys/vfs/nfs/krpc_subr.c:256-262",
    "sys/vfs/nfs/krpc_subr.c:282",
    "sys/vfs/nfs/krpc_subr.c:348-351",
    "sys/vfs/nfs/krpc_subr.c:380",
    "sys/vfs/nfs/krpc_subr.c:432-435",
    "sys/vfs/nfs/nfs_mountrpc.c:140-163",
    "sys/vfs/nfs/nfs_mountrpc.c:202-256",
    "sys/vfs/nfs/nfs_vfsops.c:557",
    "sys/vfs/nfs/nfs_vfsops.c:943",
    "sys/config/X86_64_GENERIC:29"
  ],
  "artifacts": ["README.md", "VERDICT.md", "dfrig13_krpc.c", "attacker.c", "build.sh", "run.sh", "blindboot.sh", "run_fixed.sh", "run.log", "run.blindboot.log", "run.fixed.log", "dump.log", "spoof.log", "pmap.log", "pmap_blind.log", "fx_dump.log", "fx_spoof.log", "fx_pmap.log", "build.log", "build_fixed.log", "fix.diff", "fix_all.diff", "krpc_subr.fixed.c", "env.txt", "manifest.json", "verdict.json"]
}