⬢ DragonFlyBSD Kernel Audit
DF-3344 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-3344",
  "manifest_version": 1,
  "title": "lagg port-detach handler registered on never-fired ifnet_departure_event: persistent kernel UAF after member interface destroy",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cc -O -o /tmp/laggleak laggleak.c -I/usr/src/sys && cc -O -o /tmp/udptx udptx.c",
    "run": "./run.sh (root setup via vm.sh run_root; leak/tx via vm.sh run_user as uid=1001; panic via root 'ifconfig lagg0 laggproto lacp')",
    "expected": "post-destroy, unprivileged SIOCGLAGG still lists the destroyed member (name read from freed heap; mutates to 'tap2' after slab reuse); 'ifconfig lagg0 laggproto lacp' -> Fatal trap 12, Stopped at tapifioctl+0x158, guest down at DDB"
  },
  "kernel_refs": [
    "sys/net/lagg/if_lagg.c:218",
    "sys/net/lagg/if_lagg.c:223",
    "sys/net/lagg/if_lagg.c:924",
    "sys/net/lagg/if_lagg.c:2085",
    "sys/net/if.c:958",
    "sys/net/if_var.h:724",
    "sys/net/bridge/if_bridge.c:609",
    "sys/net/tap/if_tap.c:495",
    "sys/net/lagg/if_lagg.c:951",
    "sys/net/lagg/if_lagg.c:763"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "laggleak.c", "udptx.c", "build.sh", "run.sh",
    "run.log", "panic.txt", "fix.diff", "fix_validation.log",
    "manifest.json", "verdict.json"
  ]
}