⬢ DragonFlyBSD Kernel Audit
DF-3879 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
  "finding_id": "DF-3879",
  "verdict": "reproduced (kernel path; QEMU intel-hda audio attached, pcm0 + /dev/dsp 0666 live)",
  "impact_demonstrated": "deterministic unprivileged kernel panic (two signatures: KASSERT sndbuf_getbufofs ofs invalid 268435456 during mmap; Fatal trap 12 in pmap_kextract via the device-pager ctor walk — the latter INVARIANTS-independent)",
  "impact_ceiling": "arbitrary kernel-memory R/W within 4GB of the sound soft buffer -> uid=0 on non-INVARIANTS builds (heap-layout dependent window [b->buf+4GB-S, b->buf+4GB)); deterministic local DoS on all builds",
  "reproduce": {
    "boot_guest_with_audio": "qemu ... -audiodev none,id=snd0 -device intel-hda -device hda-duplex,audiodev=snd0 ; in guest: kldload snd_hda (pcm0 attaches, /dev/dsp 0666)",
    "build": "guest: cc -O2 -Wall -o /tmp/mmap_ofs /tmp/mmap_ofs_overflow.c",
    "run": "guest as unprivileged user: /tmp/mmap_ofs; echo exit=$?",
    "expected_stock": "ssh session dies; serial console: 'panic: sndbuf_getbufofs: ofs invalid 268435456' + backtrace kern_mmap -> vm_mmap -> dev_dmmap_single -> dsp_mmap_single -> sndbuf_getbufofs",
    "expected_fixed": "mmap: Invalid argument (errno=22), exit=0, guest stays up; legit mmap(off=0, size=bufsize) still works"
  },
  "verification_discoveries": [
    "vm_ooffset_t is SIGNED (sys/cpu/x86_64/include/types.h:44) — the bypass is an undetected negative mmap offset, not a u64 wrap; PoC numbers unchanged",
    "originally-filed fix v1 (signed compares) proven INSUFFICIENT on a built kernel — variant B still panicked; superseded by v2 unsigned-compare fix (kernel-validated)",
    "old-style device pager ctor validates every page upfront (device_pager.c:326-333) — shapes attack geometry and makes large-S attacks panic in pmap_kextract during mmap (INVARIANTS-independent)",
    "dsp.c lives in sound.ko module, not the kernel binary — fix validation requires the rebuilt module"
  ],
  "kernel_refs": [
    "sys/dev/sound/pcm/dsp.c:2342",
    "sys/dev/sound/pcm/dsp.c:2355",
    "sys/dev/sound/pcm/dsp.c:2357",
    "sys/dev/sound/pcm/dsp.c:2287",
    "sys/dev/sound/pcm/buffer.c:424",
    "sys/dev/sound/pcm/channel.c:1247",
    "sys/cpu/x86_64/include/types.h:44",
    "sys/vm/vm_mmap.c:195",
    "sys/vm/device_pager.c:326",
    "sys/platform/pc64/x86_64/pmap.c:1865"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "mmap_ofs_overflow.c", "mmap_alias_rw.c",
    "mmap_onepage.c", "kmemprobe.c", "sanity_mmap.c",
    "build.sh", "run.sh", "build.log", "run.log",
    "panic.txt", "panic.pmap.txt", "env.audio.txt", "env.txt",
    "fix.diff", "fix_env.txt", "fix_build.log",
    "fix_run_variantB.log", "fix_run_variantA_sanity.log",
    "manifest.json", "verdict.json"
  ]
}