⬢ DragonFlyBSD Kernel Audit
DF-3941 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-3941",
  "title": "cxm(4) cxm_read() consumes the DMA ring unlocked: offset/buffer mismatch size_t underflow -> OOB kernel-heap read via read(2); desync reads leak uninitialized DMA buffers",
  "verdict": "inconclusive",
  "impact": "kernel-heap info leak ( Medium-class, hardware-gated )",
  "confidence": "likely",
  "reproduce": {
    "build": "cc -O2 -Wall -o /tmp/cxm_read_race cxm_read_race.c",
    "run": "/tmp/cxm_read_race",
    "expected": "On CX23416 hardware: racing forked readers trigger ring desync; read() returns non-MPEG kernel-heap data. On the audit guest (no such PCI device): open() = ENOENT (documented in run.log)."
  },
  "kernel_refs": [
    "sys/dev/video/cxm/cxm.c:2211",
    "sys/dev/video/cxm/cxm.c:2244",
    "sys/dev/video/cxm/cxm.c:2262",
    "sys/dev/video/cxm/cxm.c:2270",
    "sys/dev/video/cxm/cxm.c:2276",
    "sys/dev/video/cxm/cxm.c:2290",
    "sys/dev/video/cxm/cxm.c:1119",
    "sys/dev/video/cxm/cxm.c:2158",
    "sys/dev/video/cxm/cxm.c:1885",
    "sys/dev/video/cxm/cxm.c:1806",
    "sys/dev/video/cxm/cxm.h:74"
  ],
  "artifacts": [
    "cxm_read_race.c", "build.sh", "run.sh", "build.log", "run.log",
    "env.txt", "fix.diff", "fix_build.log", "VERDICT.md", "README.md",
    "verdict.json", "manifest.json"
  ]
}