⬢ DragonFlyBSD Kernel Audit
DF-3733 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3733",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "INCONCLUSIVE at runtime (no hardware; race needs a real controller detach), source-certain: ciss_periodic re-arms itself AFTER releasing ciss_lock (ciss.c:3431 vs 3436) while ciss_free stops the callout under the lock (ciss.c:1874) and then terminates/uninits around further teardown (ciss.c:1902-1908) -> stop-vs-rearm race leaves an armed callout on a freed softc -> post-free ciss_periodic execution (UAF). Privileged-detach-gated -> Low severity. Same callout_init_lk discipline as the mpt/arcmsr findings.",
  "exploit_chain": "kldunload/detach races heartbeat tick -> callout_stop sees non-pending callout -> handler re-arms after terminate -> ciss_periodic on freed softc",
  "evidence": "VERDICT.md interleaving analysis; fix_apply.log + fix_build.log",
  "kernel_refs": [
    "sys/dev/raid/ciss/ciss.c:3431",
    "sys/dev/raid/ciss/ciss.c:3436",
    "sys/dev/raid/ciss/ciss.c:1874",
    "sys/dev/raid/ciss/ciss.c:1902",
    "sys/dev/raid/ciss/ciss.c:1907",
    "sys/dev/raid/ciss/ciss.c:429",
    "sys/sys/callout.h:131"
  ],
  "poc_changes": "no runnable PoC (race, hardware-gated); source-level pack",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 1,
  "build_cmd": "(none - source-level pack)",
  "run_cmd": "(none - source-level pack)",
  "code_hash": "7b58e2738544bffd01f4cddbe7dda6d62bc0ff7ecb5e1849076877db7d5d72a2",
  "notes": "Guest has no HP Smart Array hardware (env.txt); harness-level verification per the established DF-1190 methodology. Guest dirtied by fix-validation patch build; vm.sh reset with-src run afterwards.",
  "recommended_fix": "convert the periodic callout to callout_init_lk(&sc->ciss_periodic, &sc->ciss_lock)",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "callout_init_lk(&sc->ciss_periodic, &sc->ciss_lock) + handler-side lock removal + wrapped attach-time call: stop/reset/handler serialized under one lock. Compile-validated (-Werror, link rc=0). Race not live-testable.",
  "fix_evidence": "fix.diff (5 hunks); fix_apply.log; fix_build.log"
}