⬢ DragonFlyBSD Kernel Audit
DF-3235 / leak_sample.txt
← back to finding ↓ download raw
DF-3235 leak samples: torn reads of /proc/<victim>/cmdline returning the
FILLER process's argv bytes out of a recycled (freed) kernel M_PARGS chunk.
The victim's argv alphabet contains only: "/home/maxx/racer", "victim", "A",
'A'-padding.  The bytes 'F'*runs and the tail below the tear are the filler's
argv pad (MARKER + 'F's).  No legitimate read of /proc/<victim>/cmdline can
ever return 'F' bytes.

=== run.12.log (stock kernel #0) - torn read #1 ===
[reader 2242] ANOMALY: 184B 8.00ms: /home/maxx/racer.victim.A.AAAA...AAAAFFFF.FFF.  (tear at ~byte 134)

=== run.13.log (stock kernel #0) - torn read #2 (hit criterion) ===
[reader 2271] HIT: 184B 4.62ms: /home/maxx/racer.victim.A.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF.

=== run.15.log (stock kernel #0) - torn reads #3 and #4 ===
[reader 2308] ANOMALY: 184B 3.38ms: /home/maxx/racer.victim.A.AAAA...AAAAFF.       (tear at ~byte 182)
[reader 2309] HIT: 184B 5.27ms: /home/maxx/racer.victim.A.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF.

=== patched kernel #1 (fix.diff applied): 2 x 300s runs, zero anomalies ===
run.fix.1.log: args=2241/2235 (slow=2241/2235) anom=0, RESULT: no hit
run.fix.2.log: args=9592/9551 (slow=9592/9551) anom=0, RESULT: no hit
(every one of those p_args reads blocked ms-scale in the copyout fault -
the race window was wide open - yet zero torn/reused bytes came back)