⬢ DragonFlyBSD Kernel Audit
DF-3692 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
{
 "finding_id": "DF-3692",
 "verdict": {
  "finding_id": "DF-3692",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "The four RAID ioctls pass an unvalidated int lun into ata_raid_arrays[16] (kernel .bss). IOCATARAIDREBUILD with lun=0x8000000 faulted exactly at the OOB table read (fault VA = &ata_raid_arrays[0]+8*lun), panic in ata_raid_ioctl+0x154, guest wedged. Same index drives STATUS (wild-object fields copied to userspace - kernleak; wild device derefs), REBUILD (writes through wild pointer) and DELETE (disk_destroy/devstat_remove_entry/kfree on wild pointer - arbitrary free); those variants are source-certain but not individually exercised. Root-gated (0600 root:operator /dev/ata) so Medium despite the kfree primitive.",
  "exploit_chain": "root opens /dev/ata -> IOCATARAIDREBUILD lun=0x8000000 -> ata_raid_ioctl dispatch -> movq ata_raid_arrays(,%rax,8) OOB read -> unmapped kernel VA -> fatal trap 12, DDB wedge. With lun chosen so the slot holds a controlled/known pointer, DELETE yields kfree(<known ptr>) and STATUS yields two-level kernel memory disclosure - same index family.",
  "evidence": "run.log (baseline ENXIO in-bounds vs OOB panic; Stopped-at line names the exact faulting instruction), panic.txt full trap frame",
  "kernel_refs": [
   "sys/dev/disk/nata/ata-raid.c:249",
   "sys/dev/disk/nata/ata-raid.c:257",
   "sys/dev/disk/nata/ata-raid.c:261",
   "sys/dev/disk/nata/ata-raid.c:265",
   "sys/dev/disk/nata/ata-raid.c:1008",
   "sys/dev/disk/nata/ata-raid.c:1287",
   "sys/dev/disk/nata/ata-raid.c:1323",
   "sys/dev/disk/nata/ata-raid.c:1373"
  ],
  "poc_changes": "ioctl numbers/_IOWR sizes taken from sys/sys/nata.h (IOCATARAIDREBUILD _IOW('a',204,int)); none of the seed-typical errors",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 150,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o f3_ioctl_lun f3_ioctl_lun.c   (guest)",
  "run_cmd": "/tmp/poc/f3_ioctl_lun rebuild 134217728   (root)",
  "code_hash": "",
  "notes": "Distinct from DF-2495 (total_disks loops in create/status). ata_raid_arrays at 0xffffffff8114dec0 on this no-KASLR guest (from fault VA arithmetic).",
  "recommended_fix": "bounds-check lun/array (0..MAX_ARRAYS-1) in all four subcommands (fix.diff hunks 1,2,4,5)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched kernel: same ioctl returns 'Invalid argument' (EINVAL), guest stays up; in-bounds status 0 still ENXIO. Panic gone.",
  "fix_evidence": "run.patched.log: 'rebuild ioctl: Invalid argument' + uptime continues"
 },
 "reproduce": {
  "build": "cc -O -o f3_ioctl_lun f3_ioctl_lun.c (guest)",
  "run": "/tmp/poc/f3_ioctl_lun rebuild 134217728   (root; panic)",
  "expected": "Fatal trap 12 at ata_raid_ioctl+0x154 (ata_raid_arrays OOB read)"
 },
 "kernel_refs": [
  "sys/dev/disk/nata/ata-raid.c:249",
  "sys/dev/disk/nata/ata-raid.c:1287",
  "sys/dev/disk/nata/ata-raid.c:1373"
 ],
 "artifacts": [
  "README.md",
  "VERDICT.md",
  "f3_ioctl_lun.c",
  "build.sh",
  "run.sh",
  "run.log",
  "panic.txt",
  "run.patched.log",
  "fix.diff",
  "env.txt",
  "verdict.json",
  "manifest.json"
 ],
 "code_hash": "d8eea2a403c8a8dc119821478767e8955b1e3d83877f90dbfd91b4f923d55f90"
}