⬢ DragonFlyBSD Kernel Audit
DF-4026 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "finding_id": "DF-4026",
  "title": "/dev/dsp mmap-vs-chn_resizebuf use-after-free: userland RW over freed kernel heap",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "fix_status": "fixed",
  "reproduce": {
    "build": "cc -O2 -Wall -pthread -o /tmp/mmap_resize_uaf /tmp/mmap_resize_uaf.c",
    "run": "/tmp/mmap_resize_uaf 3000",
    "expected": "stock: HIT within 0-73 rounds + 'UAF READ+WRITE ... CONFIRMED'; patched sound.ko (fix.diff): 'no window caught in 3000 attempts'"
  },
  "kernel_refs": [
    "sys/dev/sound/pcm/channel.c:1762",
    "sys/dev/sound/pcm/channel.c:1815-1819",
    "sys/dev/sound/pcm/channel.c:1858-1864",
    "sys/dev/sound/pcm/channel.c:1910",
    "sys/dev/sound/pcm/buffer.c:224-228",
    "sys/dev/sound/pcm/buffer.c:229-237",
    "sys/dev/sound/pcm/dsp.c:2297-2364"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "mmap_resize_uaf.c", "build.sh", "build.log",
    "run.log", "run.2.log", "run.3.log", "run.fix.log", "fix.diff",
    "env.txt", "panic.sndstat-unload.txt", "manifest.json", "verdict.json"
  ]
}