⬢ DragonFlyBSD Kernel Audit
DF-3433 / setup_async.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
#!/bin/sh
# DF-3433 - async-path stf teardown UAF.
# Root setup: tap0 as the v4 anchor, stf0 with a matching 6to4 address,
# INVARIANTS kfree-poisoning so post-free derefs land on 0xdeadc0de.
set -e
ifconfig tap0 create 2>/dev/null || true
ifconfig tap0 up
ifconfig tap0 inet 10.99.0.1 netmask 255.255.255.0
kldload if_stf 2>/dev/null || true
ifconfig stf0 inet6 2002:0a63:0001::1/16
ifconfig stf0
ifconfig tap0 | head -2
sysctl debug.use_weird_array=1