⬢ DragonFlyBSD Kernel Audit
DF-3235 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3235",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O2 -Wall -pthread -o /home/maxx/racer /home/maxx/racer.c  (plus one-time: dd if=/dev/urandom of=/home/maxx/.racer_big bs=4m count=880)",
    "run": "cd /home/maxx && ./racer 240 6",
    "expected": "[reader N] HIT: 184B <t>ms: /home/maxx/racer.victim.A.AAAA...FFFF... / RESULT: UAF-READ REPRODUCED (impossible 'F' filler bytes = recycled pargs chunk content); on fix.diff kernel: no hit, anom=0"
  },
  "kernel_refs": [
    "sys/vfs/procfs/procfs_status.c:202-247",
    "sys/vfs/procfs/procfs_status.c:292",
    "sys/vfs/procfs/procfs_subr.c:281-306",
    "sys/kern/kern_exec.c:589-608",
    "sys/kern/kern_exec.c:432-433",
    "sys/kern/kern_exec.c:981-982",
    "sys/kern/kern_proc.c:1943-1949",
    "sys/kern/kern_proc.c:1300-1310",
    "sys/kern/kern_proc.c:1356-1383",
    "sys/kern/kern_exit.c:688",
    "sys/kern/lwkt_token.c:40",
    "sys/kern/kern_subr.c:96-160"
  ],
  "artifacts": [
    "racer.c", "build.sh", "run.sh", "build.log", "run.log", "run.2.log",
    "run.3.log", "run.5.log", "run.6.log", "run.7.log", "run.8.log",
    "run.9.log", "run.10.log", "run.11.log", "run.12.log", "run.13.log",
    "run.14.log", "run.15.log", "run.fix.1.log", "run.fix.2.log",
    "leak_sample.txt", "env.txt", "fix.diff", "fix_build.log",
    "VERDICT.md", "README.md", "manifest.json", "verdict.json"
  ]
}