⬢ DragonFlyBSD Kernel Audit
DF-3212 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-3212",
  "verdict": "reproduced",
  "impact": "leak",
  "kernel_refs": [
    "sys/vfs/ufs/ufs_readwrite.c:141",
    "sys/vfs/ufs/ufs_readwrite.c:142",
    "sys/vfs/ufs/ufs_readwrite.c:143",
    "sys/vfs/ufs/ufs_readwrite.c:147",
    "sys/vfs/ufs/ufs_readwrite.c:155",
    "sys/vfs/ufs/fs.h:487",
    "sys/vfs/ufs/ffs_subr.c:97",
    "sys/vfs/ufs/ffs_vfsops.c:642",
    "sys/vfs/ufs/ffs_vfsops.c:802",
    "sys/kern/vfs_bio.c:640"
  ],
  "reproduce": {
    "build": "cc -O -o craft_img craft_img.c && cc -O -o trigger trigger.c && cc -O -o trigger2 trigger2.c  (inside guest; see build.sh)",
    "run": "sh setup.sh (root: image + fs_qbmask 0x1fff->0x7ffff + mount -o noatime,noclusterr) ; su -m pwn -c '/tmp/trigger2 /mnt/test/leak.bin'",
    "expected": "stock kernel: preads at valid offsets return non-zero kernel memory (kernel .text/.rodata windows, other files' cached pages) or EFAULT; clean-fs control returns all zeros; fixed kernel: EIO on every invalid-geometry pread, control unchanged (15/15 zeros)"
  },
  "artifacts": [
    "README.md", "VERDICT.md", "craft_img.c", "trigger.c", "trigger2.c",
    "setup.sh", "run.sh", "build.sh",
    "run.control_and_trig1.log", "run2.trigger2.log",
    "fix_build.log", "fix_patched_mount.log", "fix_patched_run.log",
    "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}