⬢ DragonFlyBSD Kernel Audit
DF-3273 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "verdict": "reproduced",
  "impact": "panic (remote peer, single frame)",
  "reproduce": {
    "build": "cd /root/poc && make && cc -O2 -o poc_3273 poc_3273.c",
    "run": "kldload /root/poc/sppp_harness.ko && ./poc_3273",
    "expected": "instant panic: 'vm_map_entry_link: dup addr map' via kmem_slab_alloc <- _kmalloc (panic.txt); with fix.diff: frame rejected, kernel stays up"
  },
  "kernel_refs": [
    "sys/net/sppp/if_spppsubr.c:1412",
    "sys/net/sppp/if_spppsubr.c:1541",
    "sys/net/sppp/if_spppsubr.c:2419",
    "sys/net/sppp/if_spppsubr.c:2492",
    "sys/net/sppp/if_spppsubr.c:3090",
    "sys/net/sppp/if_spppsubr.c:3142",
    "sys/net/sppp/if_spppsubr.c:3530",
    "sys/net/sppp/if_spppsubr.c:3581",
    "sys/kern/kern_slaballoc.c:942",
    "sys/kern/kern_slaballoc.c:1706"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "poc_3273.c", "sppp_harness.c",
    "build.sh", "run.sh", "panic.txt", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}