⬢ DragonFlyBSD Kernel Audit
DF-3296 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cc -O2 -o trigger_changeaddr trigger_changeaddr.c && cc -O2 -o fixcheck fixcheck.c",
    "run": "kldload pf.ko; ./trigger_changeaddr   # ioctl variant: panic in pf_addrcpy (VA 0 read)",
    "expected": "Fatal trap 12: page fault while in kernel mode / fault virtual address = 0x0 / Stopped at pf_addrcpy+0x11: movl (%rsi),%eax  (variant 2 './trigger_changeaddr datapath enable': Stopped at pf_map_addr+0x76)"
  },
  "kernel_refs": [
    "sys/net/pf/pf_ioctl.c:2313",
    "sys/net/pf/pf_ioctl.c:2330",
    "sys/net/pf/pf_ioctl.c:2331",
    "sys/net/pf/pf.c:411",
    "sys/net/pf/pf.c:2693",
    "sys/net/pf/pf.c:2712"
  ],
  "artifacts": [
    "trigger_changeaddr.c", "fixcheck.c", "build.sh", "run.sh",
    "build.log", "run.log", "panic.txt", "env.txt", "fix.diff",
    "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}