⬢ DragonFlyBSD Kernel Audit
DF-3378 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{
  "finding_id": "DF-3378",
  "title": "MRT6_INIT length gate uses sizeof(int*) (8) instead of sizeof(int) (4): IPv6 multicast routing cannot be enabled by any conforming daemon on amd64",
  "verdict": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O -Wall -o /tmp/df3378 /root/poc/trigger_mrt6_init.c",
    "run": "/tmp/df3378   (as root)",
    "expected": "stock kernel #0: 'MRT6_INIT(4-byte int arg): rc=-1 errno=42 (Protocol not available)' + 'MRT6_INIT(8-byte arg): rc=0'. fixed kernel #1: 4-byte line becomes rc=0 (8-byte becomes EADDRINUSE because the first call now succeeds)."
  },
  "kernel_refs": [
    "sys/netinet6/ip6_mroute.c:426",
    "sys/netinet6/ip6_mroute.c:429-430",
    "sys/kern/uipc_socket.c:2438-2469",
    "sys/netinet6/raw_ip6.c:496-499"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "trigger_mrt6_init.c", "build.sh", "run.sh",
    "build.log", "run.log", "fix_run.log", "fix_build.log",
    "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}