⬢ DragonFlyBSD Kernel Audit
DF-3453 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-3453",
  "title": "pfil COW hook-list free races pfil_run_hooks walkers on non-netisr threads (softclock via ip_mroute tbf, IDIRECT bridge interrupts) - UAF with indirect call; stock INVARIANTS kernel panics on the mroute softclock ip_output path",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "likely",
  "reproduce": {
    "build": "cc -O2 -o pfilrace_feeder pfilrace_feeder.c; cd prhook && make -m /usr/src/share/mk",
    "run": "kldload ip_mroute; ./pfilrace_feeder <vtnet0-addr> 1000   (INVARIANTS kernel: panics in seconds); kldload prhook.ko; sysctl -w net.prhook_delay_ms=150; sysctl -w net.prhook_toggle=1; ./pfilrace_feeder <addr> 1000 &; sysctl -w net.prhook_toggle=1  (mutation; see VERDICT for the CPU-pinning caveat)",
    "expected": "INVARIANTS: 'panic: thread ... is not within netisr_ncpus' with tbf_reprocess_q<-softclock_handler backtrace. Production kernel: softclock pegged in pfil walk, spray_hit 2/2; end-to-end wild call blocked by same-CPU LWKT serialization on this 6-vCPU guest."
  },
  "kernel_refs": [
    "sys/net/pfil.c:47",
    "sys/net/pfil.c:93",
    "sys/net/pfil.c:110",
    "sys/net/pfil.c:238",
    "sys/net/pfil.c:244",
    "sys/net/pfil.c:346",
    "sys/net/pfil.c:351",
    "sys/net/netisr.c:229",
    "sys/net/netisr.c:292",
    "sys/netinet/ip_output.c:185",
    "sys/netinet/ip_output.c:529",
    "sys/net/ip_mroute/ip_mroute.c:1792",
    "sys/net/ip_mroute/ip_mroute.c:1874",
    "sys/net/ip_mroute/ip_mroute.c:1926",
    "sys/net/ip_mroute/ip_mroute.c:1931",
    "sys/kern/kern_timeout.c:423",
    "sys/net/if_ethersubr.c:1457",
    "sys/net/bridge/if_bridge.c:4097"
  ],
  "artifacts": [
    "prhook.c", "prhook/Makefile", "pfilrace_feeder.c", "pfilrace.sh",
    "run.sh", "build.sh", "build.log", "run.log", "panic.txt", "env.txt",
    "fix.diff", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}