⬢ DragonFlyBSD Kernel Audit
DF-3540 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{
  "finding_id": "DF-3540",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /usr/src/sys/netgraph7/netgraph && make && (cd ../socket && make) && (cd ../bpf && make) && cc -O2 -o bpf_cycle bpf_cycle.c",
    "run": "kldload netgraph.ko ng_socket.ko ng_bpf.ko (full paths); ./bpf_cycle self   (root)",
    "expected": "panic: assertion \"ref < &td->td_toks_end\" failed in lwkt_gettoken_shared at sys/kern/lwkt_token.c:732; ng_apply_item recursion in trace; guest down"
  },
  "kernel_refs": [
    "sys/netgraph7/bpf/ng_bpf.c:584",
    "sys/netgraph7/bpf/ng_bpf.c:500",
    "sys/netgraph7/netgraph/ng_base.c:1961",
    "sys/kern/lwkt_token.c:732"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "bpf_cycle.c", "build.sh", "run.sh",
    "run.log", "unpriv_check.txt", "panic.txt", "console_full.txt",
    "console_cross.txt", "stock_cross_run.log", "fix1_self.log",
    "fix1_cross.log", "fix2_self.log", "fix2_cross.log", "fix.diff",
    "verdict.json", "manifest.json"
  ]
}