⬢ DragonFlyBSD Kernel Audit
DF-3716 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
{
  "finding_id": "DF-3716",
  "title": "mxge_rx_done_big trusts NIC-DMA'd 16-bit completion length with no posted-cluster bound: heap OOB read up to ~63.5KB past the 2/4KiB RX cluster (DF-3604/3639/3663/3679/3713 family)",
  "verdict": "inconclusive",
  "impact": "none",
  "confidence": "certain",
  "mechanism_guest_proven": false,
  "reproduce": {
    "build": "n/a (hardware-gated)",
    "run": "n/a (hardware-gated; guest has no Myricom 0x14c1 device)",
    "expected": "source-level: length in (MHLEN-2, 65535] from rx_done slot -> m_len beyond rx->cl_size -> stack reads past cluster"
  },
  "kernel_refs": [
    "sys/dev/netif/mxge/if_mxge.c:2345",
    "sys/dev/netif/mxge/if_mxge.c:2350",
    "sys/dev/netif/mxge/if_mxge.c:2261",
    "sys/dev/netif/mxge/if_mxge.c:2101",
    "sys/dev/netif/mxge/if_mxge.c:3228"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "verdict.json", "manifest.json", "env.txt"]
}