⬢ DragonFlyBSD Kernel Audit
DF-3570 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
  "finding_id": "DF-3570",
  "title": "MP_ReadOtherFunPciEConfigSpace never reads RE_CSIDR (constant 0xffffffff) -> NULL CMAC bus_space handle dereference at attach on RTL8168FP/RTL8117 + PCIe config RMW clobbering",
  "verdict": "not_reproduced",
  "impact": "none (on audit guest: no Realtek hardware; real-world: deterministic kernel panic at re(4) attach on MACFG_70-72 silicon, plus device config clobbering on CSIAR RMW users)",
  "confidence": "certain (source-proven; runtime un-runnable on guest hardware)",
  "reproduce": {
    "build": "nothing to build; on target hardware: kldload if_re with an RTL8168FP/RTL8117 present",
    "run": "kldload if_re   (or boot with device present)",
    "expected": "unpatched: kernel page fault in Dash2DisableTx during rtl_exit_oob (fault addr 0xF9); patched: clean attach"
  },
  "kernel_refs": [
    "sys/dev/netif/re/re.c:31163-31192",
    "sys/dev/netif/re/re.c:31171",
    "sys/dev/netif/re/re.c:31191",
    "sys/dev/netif/re/re.c:31148",
    "sys/dev/netif/re/re.c:4413-4417",
    "sys/dev/netif/re/re.c:4451-4473",
    "sys/dev/netif/re/re.c:4456-4457",
    "sys/dev/netif/re/re.c:4484-4489",
    "sys/dev/netif/re/re.c:3588-3596",
    "sys/dev/netif/re/re.c:3445-3453",
    "sys/dev/netif/re/re_dragonfly.h:43-54",
    "sys/cpu/x86_64/include/bus_dma.h:135-141",
    "sys/dev/netif/re/if_re.c:772",
    "sys/dev/netif/re/re.c:3891-3893"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "trigger.c",
    "proof.sh",
    "proof.log",
    "run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}