⬢ DragonFlyBSD Kernel Audit
DF-3679 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-3679",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, runtime-inconclusive: igb_rxeof() assigns the NIC-DMAd write-back length directly to m_len/m_pkthdr.len with no bound against the posted MCLBYTES(-ETHER_ALIGN) cluster, so any device-side length > the posted buffer (descriptor corruption, device fault/erratum, malicious VF/DMA source) yields a heap OOB read of up to ~63.5KB past the RX cluster via ether_input. The audit guest has no igb hardware (only vtnet0; driver compiled into kernel and /boot/kernel/if_igb.ko present) so the path cannot be exercised at runtime; module/device presence proof in run.log. Same family as DF-3604/DF-3639/DF-3663/DF-3667.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3679/VERDICT.md (root-cause trace at if_igb.c:2744,2768,2770,2776; buffer math at :2423-2437); run.log (no igb device on guest); fix.diff (dynamic-bound discard)",
  "kernel_refs": [
    "sys/dev/netif/igb/if_igb.c:2744",
    "sys/dev/netif/igb/if_igb.c:2768",
    "sys/dev/netif/igb/if_igb.c:2770",
    "sys/dev/netif/igb/if_igb.c:2776",
    "sys/dev/netif/igb/if_igb.c:2431",
    "sys/dev/netif/igb/if_igb.c:2433",
    "sys/dev/netif/igb/if_igb.c:2436",
    "sys/dev/netif/igb/if_igb.c:2820",
    "sys/dev/netif/igb/if_igb.c:2537",
    "sys/dev/netif/igb/if_igb.c:2870"
  ],
  "poc_changes": "No runnable PoC possible without igb hardware; trigger.c documents the on-hardware descriptor-injection procedure and the exact sink lines; run.sh performs the module-presence/device-absence probe.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (no-op: device-side trigger)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root kldstat | grep -i igb; ifconfig -a | grep -c ^igb; ls -l /boot/kernel/if_igb.ko",
  "code_hash": "9a558979694ca90ef46131450e48acc75452eccbb908b8eec207dd05a6d86fe0",
  "notes": "Driver is compiled into the guest kernel (kldload: already loaded or in kernel); zero igb interfaces exist. Fix not hardware-testable.",
  "recommended_fix": "Discard frames whose write-back length exceeds the posted buffer size (MCLBYTES - ETHER_ALIGN when front-trimmed, else MCLBYTES) before assigning m_len.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree; cannot be validated on a guest without igb hardware.",
  "fix_evidence": "findings/poc/DF-3679/fix.diff"
}