⬢ DragonFlyBSD Kernel Audit
DF-3320 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-3320",
  "file": "sys/netinet/in.c",
  "title": "IPv4 sin_len persisted verbatim into live in_ifaddr (in.c:998/:602/:625/:668) -> unprivileged kernel heap disclosure via SIOCGIFCONF (ifconf sa_len copyout) and route sockets",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "cd findings/poc/DF-3320 && sh build.sh",
    "run": "as root: ./setup lo0 ; then as nobody x3: ./leak 127.200.0.200",
    "expected": "entry 'lo0 sa_len=200 family=2 addr=127.200.0.200' in SIOCGIFCONF output; leaked bytes [48..199] are out-of-bounds past the 360-byte in_ifaddr; kernel heap pointers 0xfffff8004f2e79d8/e8/f8 at offsets 72/80/88, identical across 3 runs. On the fix.diff-patched kernel: setup fails EINVAL, leak finds no entry."
  },
  "kernel_refs": [
    "sys/netinet/in.c:998",
    "sys/netinet/in.c:602",
    "sys/netinet/in.c:625",
    "sys/netinet/in.c:668",
    "sys/netinet/in.c:1062-1063",
    "sys/net/if.c:1996-1997",
    "sys/net/if.c:2590-2592",
    "sys/net/rtsock.c:1140",
    "sys/net/rtsock.c:1175",
    "sys/net/rtsock.c:1202"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "setup.c", "leak.c", "build.sh", "run.sh",
    "run.log", "leak_sample.txt", "env.txt",
    "fix.diff", "fix_run.log", "fix_build.log", "verdict.json", "manifest.json"
  ]
}