⬢ DragonFlyBSD Kernel Audit
DF-3811 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3811",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "intel_ddi_init() reaches its err: label (kfree of intel_dig_port, intel_ddi.c:3893-3895) after intel_ddi_init_dp_connector() has fully registered a DP connector that stores a pointer to the encoder inside intel_dig_port (drm_connector_init + intel_connector_attach_encoder at intel_dp.c:6620/6634). The err path neither destroys nor detaches that connector, leaving a DRM-core-listed object referencing freed memory (UAF on next HPD/probe/unload). The only trigger for the second goto err is intel_connector_alloc() failure inside intel_ddi_init_hdmi_connector() (intel_ddi.c:3694), so exploitation is gated on kernel memory exhaustion during driver probe — hence Low severity. Not executed: guest has no Intel GPU; code-path property is certain from source.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3811/VERDICT.md (registration-before-failure proof with citations), findings/poc/DF-3811/env.txt",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_ddi.c:3863",
    "sys/dev/drm/i915/intel_ddi.c:3873",
    "sys/dev/drm/i915/intel_ddi.c:3893",
    "sys/dev/drm/i915/intel_ddi.c:3694",
    "sys/dev/drm/i915/intel_dp.c:6620",
    "sys/dev/drm/i915/intel_dp.c:6634"
  ],
  "poc_changes": "no PoC written; source-level analysis only (no trigger hardware)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 ... x86_64 (no i915)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding. Same file family as DF-3656 (amdgpu error-path UAF) but distinct driver/path. OOM-gated UAF; fix should demote the failure or fully unwind the DP connector.",
  "recommended_fix": "Do not kfree intel_dig_port when a DP connector is already registered - demote HDMI connector alloc failure to non-fatal or fully destroy the DP connector first",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: baseline never reproduced (no hardware)",
  "fix_evidence": ""
}