⬢ DragonFlyBSD Kernel Audit
DF-3713 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-3713",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, runtime hardware-gated: em_rxeof (sys/dev/netif/em/if_em.c:3661-3821) publishes the 16-bit NIC-DMAd descriptor length with no bound against the posted buffer: desc_len at :3692, len=desc_len (:3705) or desc_len-4 (:3701) -> mp->m_len=len at :3738 and fmp->m_pkthdr.len += len at :3761. A malicious/faulty device write-back of 0xFFFF yields an mbuf claiming 65535/65531 bytes in a 2048-byte cluster -> heap OOB read of up to 63487/63483 bytes via ether_input/BPF/forwarding, compounded per descriptor by the pkthdr accumulator; the error-path probe at :3715 reads cluster+desc_len-1 (positive direction of DF-1188); prev_len_adj (:3697-3699, :3754-3758) can drive a previous fragments m_len negative. Same family/rationale as DF-3604/DF-3639/DF-3663/DF-3667/DF-3679; DF-1188 covers only the desc_len==0 direction. Guest-executed bound-math harness demonstrates all three spans; no em hardware on the audit guest.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3713/VERDICT.md; run.log (probe + harness section [B]/[B2]: 63487/63483-byte OOB claims, probe OOB, negative m_len -2); build.log; fix.diff (discard desc_len==0 or > rx_buffer_len, also closing DF-1188)",
  "kernel_refs": [
    "sys/dev/netif/em/if_em.c:3692",
    "sys/dev/netif/em/if_em.c:3701",
    "sys/dev/netif/em/if_em.c:3705",
    "sys/dev/netif/em/if_em.c:3715",
    "sys/dev/netif/em/if_em.c:3738",
    "sys/dev/netif/em/if_em.c:3761",
    "sys/dev/netif/em/if_em.c:3697",
    "sys/dev/netif/em/if_em.c:3754",
    "sys/dev/netif/em/if_em.c:684"
  ],
  "poc_changes": "No seed PoC. em_bounds_harness.c section [B]/[B2] written for this finding; device-side descriptor-injection procedure documented in README.md.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o /root/em_bounds_harness /root/em_bounds_harness.c",
  "run_cmd": "vm.sh run_root ifconfig -l; pciconf -l; ...; harness/module per run.sh",
  "code_hash": "062bd0525775d326bb2d63520b01e5d5600be3d5f77de6e6832f262bf7aecb80",
  "notes": "Device-trust boundary (descriptor corruption / erratum / malicious DMA source incl. emulated e1000). prev_len_adj negative-m_len variant is em-specific beyond the family minimum.",
  "recommended_fix": "Discard the frame (whole fmp chain) when desc_len == 0 or desc_len > adapter->rx_buffer_len before assigning m_len.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch --dry-run clean); cannot be validated on a guest without em hardware.",
  "fix_evidence": "findings/poc/DF-3713/fix.diff"
}