⬢ DragonFlyBSD Kernel Audit
DF-3920 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
{
  "finding_id": "DF-3920",
  "title": "hptmv OsSendCommand bcopy of user-controlled cdb_len (<=255) into UCHAR Cdb[16] - kernel stack overflow",
  "verdict": "not_reproduced (hardware-gated; source-certain)",
  "impact_potential": "kernel stack memory corruption -> ring-0 (privileged trigger, specific hardware)",
  "reproduce": {
    "build": "cc -Wall -o df3920 df3920.c (needs a host with the hptmv card)",
    "run": "sudo ./df3920 <hptmv-pass-unit> 200",
    "expected": "kernel panic / stack corruption in OsSendCommand on a vulnerable driver with RR1820 present; NOT runnable on the audit guest (no 11ab:5081 PCI device)"
  },
  "kernel_refs": [
    "sys/dev/raid/hptmv/entry.c:2771",
    "sys/dev/raid/hptmv/entry.c:2777",
    "sys/dev/raid/hptmv/entry.c:2782",
    "sys/dev/raid/hptmv/entry.c:2793",
    "sys/bus/cam/scsi/scsi_pass.c:546",
    "sys/bus/cam/scsi/scsi_pass.c:308",
    "sys/kern/sys_generic.c:685"
  ],
  "artifacts": ["README.md", "VERDICT.md", "df3920.c", "fix.diff", "env.txt", "manifest.json", "verdict.json"]
}