⬢ DragonFlyBSD Kernel Audit
DF-3468 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-3468",
  "file": "sys/netproto/mpls/mpls_input.c",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "in-guest: cc -O2 -o /root/mpls_leak /root/mpls_leak.c  (after building+booting an `options MPLS` kernel: cp X86_64_GENERIC MPLSAUDIT; echo 'options MPLS'; make -j6 nativekernel KERNCONF=MPLSAUDIT; make installkernel; reboot)",
    "run": "/root/mpls_leak vtnet0 500; sleep 3; netstat -m | head -2; sleep 25; netstat -m | head -2; control: /root/mpls_leak vtnet0 500 88b7",
    "expected": "mbuf clusters in use: 256 -> 756 after 500 MPLS frames, still 756 at +28s (permanent); unknown-ethertype control frame count: +0"
  },
  "kernel_refs": [
    "sys/netproto/mpls/mpls_input.c:200-203",
    "sys/netproto/mpls/mpls_input.c:159-166",
    "sys/netproto/mpls/mpls_input.c:51-55",
    "sys/net/if_ethersubr.c:1146-1150",
    "sys/net/if_ethersubr.c:1619-1622",
    "sys/conf/files:1865-1868"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "mpls_leak.c", "build.sh", "run.sh",
    "build.log", "kernel_build.log", "run.log", "run.patched.log",
    "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ],
  "fix": {
    "status": "fixed",
    "diff": "fix.diff",
    "validated": "patched kernel: 500+500 frames -> cluster count flat at 256 (baseline reproduced 256->856 before patch)"
  }
}