⬢ DragonFlyBSD Kernel Audit
DF-3985 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{
  "finding_id": "DF-3985",
  "title": "sbp(4): sbp_free_target early-return on luns==NULL leaks the target slot forever with a dangling fw_device pointer (8-round attach DoS) and leaves freed-fwdev deref windows open",
  "verdict": "inconclusive_source_certain_hardware_gated",
  "impact_ceiling": "permanent SBP attach DoS after 8 hostile device-churn rounds + freed-slab reads feeding FireWire packet fields (spd/dst)",
  "reproduce": {
    "build": "n/a (needs FireWire hardware)",
    "run": "crafted device: present CROM_MGM but no CROM_LUN keys, then vanish (bus reset); repeat with new EUI-64 8 times",
    "expected": "every sbp_free_target call early-returns; target->fwdev never cleared; after 8 rounds sbp_new_target finds no free slot ('increase SBP_NUM_TARGETS!') and no SBP device can attach until reboot"
  },
  "kernel_refs": [
    "sys/dev/disk/sbp/sbp.c:1993",
    "sys/dev/disk/sbp/sbp.c:1998",
    "sys/dev/disk/sbp/sbp.c:586",
    "sys/dev/disk/sbp/sbp.c:816",
    "sys/dev/disk/sbp/sbp.c:776",
    "sys/dev/disk/sbp/sbp.c:393",
    "sys/dev/disk/sbp/sbp.c:1256",
    "sys/dev/disk/sbp/sbp.c:1273",
    "sys/bus/firewire/firewire.c:1600"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"]
}