⬢ DragonFlyBSD Kernel Audit
DF-3914 / run.2.log
← back to finding ↓ download raw
=== build DF-3914 ===
BUILD14_OK
=== build DF-3915 ===
BUILD15_OK
=== run DF-3914 ===
DF-3914 object-level proof
  mapping_table alloc      : 264 entries (8448 bytes)
  num_rsvd_entries         : 1
  enclosure NumSlots (fw)  : 2048
  reservation loop wrote   : [1, 2049)
  table end                : 264  -> overflow of 1785 entries (57120 bytes)
  guard[+0..] physical_id == 0x5141524153534141 at 1785/4096 entries (stride 32)
  kernel equivalent        : 57120-byte write of fw-controlled data past a 8448-byte kmalloc slab object
RESULT: OOB WRITE PRIMITIVE PROVEN (canary smash with attacker value, 32-byte stride)
RUN14_EXIT=0
=== run DF-3915 ===
DF-3915 object-level proof
  DPM entry: dev_idx=0xfff0 num_slots=0 dpm_entry_num=3
  reservation loop (:2328) iterations: 0 (DF-1282 write BYPASSED)
  mapping_table size       : 8448 bytes (max_devices=264)
  start_index*32           : 2096640 bytes past base
  read mt_entry->id        : 0x5f36 (silent garbage; kernel feeds it to NVRAM)
RESULT: WILD READ PRIMITIVE PROVEN - index 0xfff0 * 32 = 2096640 bytes past a 8448-byte allocation
RUN15_EXIT=0