⬢ DragonFlyBSD Kernel Audit
DF-3830 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-3830",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "trm_detach (sys/dev/disk/trm/trm.c:3692-3716) releases the chip I/O port FIRST (3696), frees SG maps for only the free-list SRBs (trm_destroySRB, 3697 -> 2999-3015), then frees the entire 256-entry SRB array with bus_dmamem_free (3700) and destroys every dma tag (3698-3709) BEFORE bus_teardown_intr (3710) and BEFORE the SIM is deregistered (xpt_bus_deregister/cam_sim_free, 3714-3715), with no xpt_freeze_simq and no drain: in-flight CCBs are never xpt_doned, their ccb_h.ccb_trmsrb_ptr dangles into freed memory, the still-registered interrupt can fire into released bus space, and CAM can still call trm_action against the freed softc. kldunload/hot-remove therefore yields a use-after-free and/or permanent CAM wedge. Source-certain; not exercisable on the audit guest because no Tekram PCI device exists (env.txt: pciconf shows 7 QEMU devices, none vendor 0x1DE1), so trm never attaches and detach is unreachable there.",
  "exploit_chain": "root-only/physical: kldunload trm.ko (module not in GENERIC) or surprise PCI removal while I/O is in flight -> ISR/CAM touch freed SRB array and released bus space -> UAF panic or leaked CCBs wedging the SIM queue. No unprivileged route.",
  "evidence": "VERDICT.md (order-of-operations table with line refs); env.txt (guest hardware absence); fix.diff (reordered detach + trm_detach_flush drain, git-apply --check passes)",
  "kernel_refs": [
    "sys/dev/disk/trm/trm.c:3692",
    "sys/dev/disk/trm/trm.c:3696",
    "sys/dev/disk/trm/trm.c:3697",
    "sys/dev/disk/trm/trm.c:3700",
    "sys/dev/disk/trm/trm.c:3710",
    "sys/dev/disk/trm/trm.c:3712",
    "sys/dev/disk/trm/trm.c:3714",
    "sys/dev/disk/trm/trm.c:2999",
    "sys/dev/disk/trm/trm.c:588",
    "sys/dev/disk/trm/Makefile"
  ],
  "poc_changes": "No runnable PoC exists without the PCI card; pack is analysis + fix only.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Pass-2 hunt item (d) detach teardown vs in-flight SRBs. Driver is module-only (not in X86_64_GENERIC), trigger is root kldunload or physical hot-plug, hence severity Low despite the UAF primitive.",
  "recommended_fix": "Reorder trm_detach: freeze+deregister SIM, drain/complete in-flight CCBs, bus_teardown_intr, then free DMA memory, release IOPORT last (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline and patched behavior both require an attached Tekram DC395 adapter; absent on the audit guest. fix.diff is git-apply-able against sys/dev/disk/trm/trm.c (verified) and compiles by inspection.",
  "fix_evidence": "fix.diff"
}