⬢ DragonFlyBSD Kernel Audit
DF-3720 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3720",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, hardware-gated (hostile-device premise, DF-3716/3718 family): if_mxge.c converts firmware-returned offsets (mxge_send_cmd cmd.data0) into raw pointers into the mapped SRAM BAR and writes through them with no range check - intr_coal_delay_ptr/irq_deassert/irq_claim (mxge_reset :1207-1215, written :1222 and via sysctl :1339, claimed :2717-2718), the TX/RX lanai descriptor rings (mxge_slice_open :3255-3283, PIO-written by mxge_submit_req/mxge_submit_8rx), the 128-byte RSS indirection table (:3362-3364) and the 16-byte RSS key (:3379-3384). A device returning an offset >= sram_size gets kernel MMIO writes past the pmap_mapdev window. Related: mxge_rx_ring_t.mask/cl_size are int16_t (if_mxge_var.h:65-66) filled from device ring sizes (:3960/:3194-3196), so entries >= 32768 wraps the mask negative (:3007-3009). The file already validates the adopt-path offset at :867 - the pattern exists, these loci lack it. Guest has no Myricom device; not runtime-testable.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3720/VERDICT.md; fix.diff (mxge_sram_range_valid() at all four loci, git-apply clean); env.txt",
  "kernel_refs": [
    "sys/dev/netif/mxge/if_mxge.c:1207",
    "sys/dev/netif/mxge/if_mxge.c:1222",
    "sys/dev/netif/mxge/if_mxge.c:1339",
    "sys/dev/netif/mxge/if_mxge.c:3260",
    "sys/dev/netif/mxge/if_mxge.c:3362",
    "sys/dev/netif/mxge/if_mxge.c:3379",
    "sys/dev/netif/mxge/if_mxge.c:867",
    "sys/dev/netif/mxge/if_mxge_var.h:65"
  ],
  "poc_changes": "No seed PoC; hardware-gated.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "n/a (hardware-gated)",
  "run_cmd": "n/a (hardware-gated)",
  "code_hash": "",
  "notes": "Worst sink is the RSS table write (128 attacker-influenced host bytes at device-chosen offset) and tx->lanai (descriptor-shaped data incl. host DMA addresses). int16 mask widening flagged for the maintainer.",
  "recommended_fix": "Add mxge_sram_range_valid(sc, off, len) and validate every firmware-returned offset before first use; widen mask/cl_size to int.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff git apply --check clean; not buildable without mxge hardware.",
  "fix_evidence": "findings/poc/DF-3720/fix.diff"
}