⬢ DragonFlyBSD Kernel Audit
DF-4024 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-4024",
  "title": "re_rxeof trusts the NIC-DMA'd 14-bit GFRAGLEN (RE_RXBYTES) with no bound vs MCLBYTES: single-frag m_len up to 16379 on a 2048-byte cluster (14331-byte heap OOB read into delivered frames) and multi-frag m_pkthdr.len past the fragment chain (m_copydata NULL walk -> panic)",
  "verdict": "inconclusive",
  "impact": "none_observed_leak_panic_on_hardware",
  "reproduce": {
    "build": "cc -O2 -Wall -Wextra -o /tmp/tr4024 /tmp/tr4024.c",
    "run": "/tmp/tr4024 (geometry model; on real hw: faulty/malicious NIC descriptor lie)",
    "expected": "model prints 14331-byte single-frag OOB extent + chain-walk table; on hardware: leaked heap in received frames / panic"
  },
  "kernel_refs": [
    "sys/dev/netif/re/if_re.c:1142",
    "sys/dev/netif/re/if_re.c:1187",
    "sys/dev/netif/re/if_re.c:1209",
    "sys/dev/netif/re/if_re.c:1226",
    "sys/dev/netif/re/if_re.c:1228",
    "sys/dev/netif/re/if_re.c:964",
    "sys/dev/netif/re/if_re.c:975",
    "sys/dev/netif/re/if_re.c:850",
    "sys/dev/netif/re/if_revar.h:54",
    "sys/dev/netif/re/if_rereg.h:139",
    "sys/net/if_ethersubr.c:1188",
    "sys/kern/uipc_mbuf.c:2235"
  ],
  "artifacts": ["README.md", "VERDICT.md", "trigger.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}