⬢ DragonFlyBSD Kernel Audit
DF-3353 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3353",
  "verdict": "reproduced",
  "impact": "panic",
  "severity": "Medium",
  "cvss": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "CWE-682 Incorrect Calculation",
  "title": "fs->backlogged not reset when pipe deletion purges child flowsets: p->sum accounting drift reaches 0 -> divide-by-zero panic (DF-3351 family in v3)",
  "reproduce": {
    "build": "scp dfv3.c setup.sh to guest; in-guest root: cc -O -o /tmp/dfv3 /tmp/dfv3.c",
    "run": "sh /tmp/setup.sh && /tmp/dfv3 drift",
    "expected": "kernel panic signature in serial console (see panic.txt)"
  },
  "kernel_refs": [
    "sys/net/dummynet3/ip_dummynet3.c:1618",
    "sys/net/dummynet3/ip_dummynet3.c:1627",
    "sys/net/dummynet3/ip_dummynet3.c:1681",
    "sys/net/dummynet3/ip_dummynet3.c:574"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "dfv3.c",
    "setup.sh",
    "build.sh",
    "run.sh",
    "run.log",
    "panic.txt",
    "fix.diff",
    "env.txt",
    "verdict.json",
    "manifest.json"
  ]
}