⬢ DragonFlyBSD Kernel Audit
DF-3692 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3692",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "The four RAID ioctls pass an unvalidated int lun into ata_raid_arrays[16] (kernel .bss). IOCATARAIDREBUILD with lun=0x8000000 faulted exactly at the OOB table read (fault VA = &ata_raid_arrays[0]+8*lun), panic in ata_raid_ioctl+0x154, guest wedged. Same index drives STATUS (wild-object fields copied to userspace - kernleak; wild device derefs), REBUILD (writes through wild pointer) and DELETE (disk_destroy/devstat_remove_entry/kfree on wild pointer - arbitrary free); those variants are source-certain but not individually exercised. Root-gated (0600 root:operator /dev/ata) so Medium despite the kfree primitive.",
  "exploit_chain": "root opens /dev/ata -> IOCATARAIDREBUILD lun=0x8000000 -> ata_raid_ioctl dispatch -> movq ata_raid_arrays(,%rax,8) OOB read -> unmapped kernel VA -> fatal trap 12, DDB wedge. With lun chosen so the slot holds a controlled/known pointer, DELETE yields kfree(<known ptr>) and STATUS yields two-level kernel memory disclosure - same index family.",
  "evidence": "run.log (baseline ENXIO in-bounds vs OOB panic; Stopped-at line names the exact faulting instruction), panic.txt full trap frame",
  "kernel_refs": [
    "sys/dev/disk/nata/ata-raid.c:249",
    "sys/dev/disk/nata/ata-raid.c:257",
    "sys/dev/disk/nata/ata-raid.c:261",
    "sys/dev/disk/nata/ata-raid.c:265",
    "sys/dev/disk/nata/ata-raid.c:1008",
    "sys/dev/disk/nata/ata-raid.c:1287",
    "sys/dev/disk/nata/ata-raid.c:1323",
    "sys/dev/disk/nata/ata-raid.c:1373"
  ],
  "poc_changes": "ioctl numbers/_IOWR sizes taken from sys/sys/nata.h (IOCATARAIDREBUILD _IOW(a,204,int)); none of the seed-typical errors",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 150,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o f3_ioctl_lun f3_ioctl_lun.c   (guest)",
  "run_cmd": "/tmp/poc/f3_ioctl_lun rebuild 134217728   (root)",
  "code_hash": "",
  "notes": "Distinct from DF-2495 (total_disks loops in create/status). ata_raid_arrays at 0xffffffff8114dec0 on this no-KASLR guest (from fault VA arithmetic).",
  "recommended_fix": "bounds-check lun/array (0..MAX_ARRAYS-1) in all four subcommands (fix.diff hunks 1,2,4,5)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched kernel: same ioctl returns Invalid argument (EINVAL), guest stays up; in-bounds status 0 still ENXIO. Panic gone.",
  "fix_evidence": "run.patched.log: rebuild ioctl: Invalid argument + uptime continues"
}