⬢ DragonFlyBSD Kernel Audit
DF-3822 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3822",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "aac_detach() removes and frees entries of sc->aac_container_tqh with no aac_container_lock (aac.c:679-685) while (a) aac_handle_aif() - still reachable from aac_new_intr, because bus_teardown_intr only happens later in aac_free (aac.c:625) and interrupts are masked later in aac_shutdown (aac.c:767) - walks the same list unlocked (aac.c:3269-3278) and (b) aac_query_disk() walks it under the lock (aac.c:3664-3687). The interleaving yields TAILQ_NEXT/FREE-dereference of kfreed struct aac_container (UAF). Root-detach + device-AIF/operator-ioctl preconditions; cannot be staged on the audit guest (no AAC HBA, no /dev/aacd0, zero matching PCI vendors). Locking asymmetry itself is source-certain.",
  "exploit_chain": "root detach || adapter AIF re-enumeration -> unlocked TAILQ_REMOVE/kfree races aac_handle_aifs or aac_query_disks walk -> use-after-free read through co->co_link/co_mntobj/co_disk -> panic or info disclosure of freed heap",
  "evidence": "VERDICT.md lock-state matrix; fix.diff (lock the detach removal); ../DF-3819/env.txt (guest hardware absence)",
  "kernel_refs": [
    "sys/dev/raid/aac/aac.c:679",
    "sys/dev/raid/aac/aac.c:683",
    "sys/dev/raid/aac/aac.c:625",
    "sys/dev/raid/aac/aac.c:3269",
    "sys/dev/raid/aac/aac.c:3316",
    "sys/dev/raid/aac/aac.c:3665"
  ],
  "poc_changes": "No seed; analysis pack - the race needs an attached controller.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Detach-vs-in-flight-fib family (orchestrator hint e). Severity Low: root-initiated detach + device event timing; defect is the missing lock on shared-list teardown.",
  "recommended_fix": "Hold aac_container_lock around the container TAILQ_REMOVE/kfree in aac_detach (aac.c:683).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Race requires attached AAC hardware; absent on the guest. fix.diff adds the missing lock, mirroring aac_handle_aifs removal discipline.",
  "fix_evidence": "fix.diff"
}