⬢ DragonFlyBSD Kernel Audit
DF-3663 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "verdict": "inconclusive",
  "impact": "none",
  "reproduce": {
    "build": "cc -O -Wall -o trigger trigger.c   (DragonFly guest)",
    "run": "./run.sh   (or: vm.sh run_root with kldstat/pciconf/ifconfig/sysctl proof + ./trigger)",
    "expected": "On BCM57xx hardware with a defecting NIC: bpf/tcpdump capture of up to 65531-byte 'frames' => adjacent kernel heap disclosed (std ring: ~63.5KB past a 2046-byte cluster; jumbo ring: past a 9016-byte slot). On the audit guest: hardware-precondition notice only (NO_BROADCOM_DEVICE)."
  },
  "kernel_refs": [
    "sys/dev/netif/bge/if_bge.c:3144",
    "sys/dev/netif/bge/if_bge.c:3058",
    "sys/dev/netif/bge/if_bge.c:3138",
    "sys/dev/netif/bge/if_bge.c:1027",
    "sys/dev/netif/bge/if_bge.c:1070",
    "sys/dev/netif/bge/if_bge.c:1103",
    "sys/dev/netif/bge/if_bge.c:1112",
    "sys/dev/netif/bge/if_bge.c:2206",
    "sys/dev/netif/bge/if_bgereg.h:2330",
    "sys/dev/netif/bge/if_bgevar.h:56",
    "sys/net/if_ethersubr.c:1502",
    "sys/net/if_ethersubr.c:1512"
  ],
  "artifacts": [
    "trigger.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt",
    "fix.diff", "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}