⬢ DragonFlyBSD Kernel Audit
DF-3517 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3517",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Not executed: narrow race window with panic as the only positive signal, seconds per attempt; the deterministic sibling DF-3516 (same sink) was verified instead and its fix removes the worst v1 lifetime hazard. The unsynchronized-access analysis is certain from source: v1 ng_socket.c shares ngsock/ngpcb across socket protocol threads, the netgraph netisr, and synchronous dispatch contexts (ng_send_data ng_base.c:1678-1697, ng_send_msg ng_base.c:1226) with no locks at all; ngs_rmnode:919-933 kfrees sockdata unconditionally; ng_detach_common:552-574 kfrees pcbp while ngs_rcvdata:847-882 can hold it across ssb_appendaddr. Expected worst outcomes: NULL-deref panic (Window A) or pcb/socket UAF (Window B). Unprivileged side needs a root-configured graph + concurrent teardown (same as ng7 DF-3510).",
  "exploit_chain": "",
  "evidence": "README.md enumerates mutating vs reading sites with path:line; no runtime artifacts (untested by design).",
  "kernel_refs": [
    "sys/netgraph/socket/ng_socket.c:257",
    "sys/netgraph/socket/ng_socket.c:368",
    "sys/netgraph/socket/ng_socket.c:792",
    "sys/netgraph/socket/ng_socket.c:847",
    "sys/netgraph/socket/ng_socket.c:895",
    "sys/netgraph/socket/ng_socket.c:552",
    "sys/netgraph/socket/ng_socket.c:919",
    "sys/netgraph/netgraph/ng_base.c:1678",
    "sys/netgraph/netgraph/ng_base.c:1226"
  ],
  "poc_changes": "no PoC executed; analysis-only filing",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 (analysis performed against this guests source tree; no guest execution)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "fix_status": "not_testable",
  "fix_notes": "No fix.diff authored: correct fix is a locking/reference discipline (ngsock mutex + node ref/re-check, refs-gated free in ngs_rmnode), not a two-line guard; should be co-designed with DF-3516s fix and upstream ng7 practice.",
  "notes": "v1 twin of DF-3510 (ng7); DF-0537 covered only ng7 ng_connect_data. Distinct from DF-3516 (deterministic, verified).",
  "recommended_fix": "Serialize ngsock/ngpcb access (mutex + counted node reference) and make ngs_rmnodes sockdata free reference-gated."
}