⬢ DragonFlyBSD Kernel Audit
DF-3356 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3356",
  "verdict": "reproduced",
  "impact": "dos",
  "severity": "Low",
  "cvss": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
  "cwe": "CWE-195 Signed to Unsigned Conversion Error",
  "title": "negative qsize survives set_fs_parms clamping: signed/unsigned compare in dummynet_io never fires -> unbounded queue growth / memory-exhaustion DoS (DF-0376 family in v3)",
  "reproduce": {
    "build": "scp dfv3.c setup.sh to guest; in-guest root: cc -O -o /tmp/dfv3 /tmp/dfv3.c",
    "run": "sh /tmp/setup.sh && /tmp/dfv3 qsize -1 400 (then control: qsize 50 400)",
    "expected": "GET dump shows len=399 drops=0 with qsize=-1 vs len=50 drops=349 control"
  },
  "kernel_refs": [
    "sys/net/dummynet3/ip_dummynet3.c:1442",
    "sys/net/dummynet3/ip_dummynet3.c:1446",
    "sys/net/dummynet3/ip_dummynet3.c:1100",
    "sys/net/dummynet3/ip_dummynet3.c:1104"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "dfv3.c",
    "setup.sh",
    "build.sh",
    "run.sh",
    "run.log",
    "fix.diff",
    "fix.diff",
    "env.txt",
    "verdict.json",
    "manifest.json"
  ]
}