⬢ DragonFlyBSD Kernel Audit
DF-3386 / leak_sample.txt
← back to finding ↓ download raw
cbq configured: sizeof(class_stats_t)=264 sizeof(struct redstats)=56
active altq entries: 3, ticket=1
q_def is active entry nr=2

=== run 1 (nbytes=264) ===
handle field (offset 0, uninit): 0x809af7ee
qtype=0 (1=droptail,2=RED,3=RIO)  qcnt=0
full dump (0x41 == untouched prefill):
     0: ee f7 9a 80 00 00 00 00 00 00 00 00 00 00 00 00 
    16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    32: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    48: 00 00 00 00 00 00 00 00 01 00 00 00 19 00 00 00 
    64: e7 ff ff ff 01 00 00 00 1e 00 00 00 02 00 00 00 
    80: 00 00 00 00 00 00 00 00 19 00 00 00 00 00 00 00 
    96: 00 00 00 00 00 04 00 00 ec 9b 75 81 ff ff ff ff 
   112: ec 9b 72 81 ff ff ff ff 00 00 01 00 00 00 00 00 
   128: f8 e5 c0 80 ff ff ff ff 38 d6 65 18 01 f8 ff ff 
   144: 18 fd c0 80 ff ff ff ff 00 00 00 00 00 00 00 00 
   160: fd 0c 00 00 00 00 00 00 00 40 06 4f 00 f8 ff ff 
   176: 00 00 00 00 01 f8 ff ff fd 00 00 00 49 01 00 00 
   192: 80 99 5e 49 00 f8 ff ff a0 51 9b 17 01 f8 ff ff 
   208: 73 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 
   224: 80 99 5e 49 00 f8 ff ff a8 d6 65 18 01 f8 ff ff 
   240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
   256: 80 0b 61 81 ff ff ff ff 

=== run 2 (nbytes=264) ===
handle field (offset 0, uninit): 0x809af7ee
qtype=0 (1=droptail,2=RED,3=RIO)  qcnt=0
full dump (0x41 == untouched prefill):
     0: ee f7 9a 80 00 00 00 00 00 00 00 00 00 00 00 00 
    16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    32: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    48: 00 00 00 00 00 00 00 00 01 00 00 00 19 00 00 00 
    64: e7 ff ff ff 01 00 00 00 1e 00 00 00 02 00 00 00 
    80: 00 00 00 00 00 00 00 00 19 00 00 00 00 00 00 00 
    96: 00 00 00 00 00 04 00 00 ec 9b 75 81 ff ff ff ff 
   112: 80 50 9b 17 01 f8 ff ff 00 00 01 00 00 00 00 00 
   128: cb 33 9a 80 ff ff ff ff 04 00 00 00 00 00 00 00 
   144: 80 50 9b 17 01 f8 ff ff 80 50 9b 17 01 f8 ff ff 
   160: a8 d8 65 18 01 f8 ff ff 88 d6 65 18 01 f8 ff ff 
   176: 70 d6 65 18 01 f8 ff ff 80 22 86 16 01 f8 ff ff 
   192: 00 19 5b 40 00 f8 ff ff a0 51 9b 17 01 f8 ff ff 
   208: 99 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 
   224: 00 19 5b 40 00 f8 ff ff a8 d6 65 18 01 f8 ff ff 
   240: 00 00 00 00 00 00 00 00 00 d8 65 18 01 f8 ff ff 
   256: ff ff ff ff 00 00 00 00 

=== run 3 (nbytes=264) ===
handle field (offset 0, uninit): 0x809af7ee
qtype=0 (1=droptail,2=RED,3=RIO)  qcnt=0
full dump (0x41 == untouched prefill):
     0: ee f7 9a 80 00 00 00 00 00 00 00 00 00 00 00 00 
    16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    32: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    48: 00 00 00 00 00 00 00 00 01 00 00 00 19 00 00 00 
    64: e7 ff ff ff 01 00 00 00 1e 00 00 00 02 00 00 00 
    80: 00 00 00 00 00 00 00 00 19 00 00 00 00 00 00 00 
    96: 00 00 00 00 00 04 00 00 ec 9b 75 81 ff ff ff ff 
   112: 80 50 9b 17 01 f8 ff ff 00 00 01 00 00 00 00 00 
   128: cb 33 9a 80 ff ff ff ff 04 00 00 00 00 00 00 00 
   144: 80 50 9b 17 01 f8 ff ff 80 50 9b 17 01 f8 ff ff 
   160: a8 d8 65 18 01 f8 ff ff 88 d6 65 18 01 f8 ff ff 
   176: 70 d6 65 18 01 f8 ff ff 80 22 86 16 01 f8 ff ff 
   192: 00 19 5b 40 00 f8 ff ff a0 51 9b 17 01 f8 ff ff 
   208: 99 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 
   224: 00 19 5b 40 00 f8 ff ff a8 d6 65 18 01 f8 ff ff 
   240: 00 00 00 00 00 00 00 00 00 d8 65 18 01 f8 ff ff 
   256: ff ff ff ff 00 00 00 00 

Interpretation: any byte != 0x41 in the first 4 bytes (handle)
and in the last 168 bytes (red[3]) is uninitialized kernel stack
leaked to userspace.