⬢ DragonFlyBSD Kernel Audit
DF-3930 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-3930",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated on the guest: the trigger path requires mly/age hardware absent from the audit guest. fix.diff is mechanical (bounds/termination-only) and authored post-verification against the cited lines.",
  "fix_evidence": "findings/poc/DF-3930/fix.diff + VERDICT.md",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardware-gated (no mly controller / logical volume in the guest); source-certain. mly_cam_complete (mly.c:2331-2346), on SCSI_STATUS_OK for a logical target with CDB[0]==INQUIRY, unconditionally rewrites the inquiry data at data_ptr+8..36 via padstr regardless of the CCBs dxfer_len. pass(4) forwards user-chosen buffers: a 6-byte INQUIRY CDB with a 4-byte data-in buffer (camcontrol cmd 3:0:0 -c 12 00 00 00 04 00 -d 4) makes the driver write ~32 bytes of static device-descriptive text past a 4-byte kmalloc - bounded heap OOB write with length/offset attacker-chosen (dxfer_len 0..35), clobbering adjacent slab chunk headers. Known DF-1289 covers the sense_data bcopy in the same function (:2356-2358); this is the distinct INQUIRY-rewrite path. Not runtime-reproduced (hardware absent); certain at source level.",
  "exploit_chain": "privileged pass(4) user sends short INQUIRY data-in CCB to an mly logical volume -> padstr writes at data_ptr[8..36) past the short kernel buffer -> adjacent heap metadata corruption",
  "evidence": "findings/poc/DF-3930/VERDICT.md; README.md (exact camcontrol trigger); fix.diff (dxfer_len >= 36 gate)",
  "kernel_refs": [
    "sys/dev/raid/mly/mly.c:2318",
    "sys/dev/raid/mly/mly.c:2331",
    "sys/dev/raid/mly/mly.c:2343",
    "sys/dev/raid/mly/mlyvar.h:362"
  ],
  "poc_changes": "No seed PoC; trigger documented as camcontrol/pass CCB one-liner in README.md.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 180,
  "guest_dirty": 0,
  "notes": "pass-2 GLM5.3. Written content is static text, not attacker bytes; impact bounded but real (chunk-header clobber).",
  "recommended_fix": "Only rewrite inquiry vendor/product/revision when csio->dxfer_len >= 36.",
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null
}