⬢ DragonFlyBSD Kernel Audit
DF-4067 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
{
  "finding_id": "DF-4067",
  "title": "ti_rxeof trusts the NIC-DMA'd 16-bit return-descriptor ti_len with no bound vs the backing buffer: std-ring m_len up to 65535 on a 2048-byte cluster (63489-byte heap OOB read into delivered frames), jumbo up to 56513 bytes past a 9024-byte slot -- DF-3604/3989/4024/4045/4055 family, ti(4) instance",
  "verdict": "inconclusive",
  "impact": "none_observed_hw_gated__source_kernel_heap_info_leak",
  "reproduce": {
    "build": "cc -O2 -Wall -Wextra -o /tmp/df4067 /tmp/df4067.c",
    "run": "/tmp/df4067 (extent model; on real hw: faulty/malicious NIC descriptor length lie)",
    "expected": "model prints per-ring OOB extents (RC_DF4067_MODEL=0); on hardware: leaked heap in received frames / panic"
  },
  "kernel_refs": [
    "sys/dev/netif/ti/if_ti.c:1690",
    "sys/dev/netif/ti/if_ti.c:1706",
    "sys/dev/netif/ti/if_ti.c:1279",
    "sys/dev/netif/ti/if_ti.c:1305",
    "sys/dev/netif/ti/if_tireg.h:710"
  ],
  "artifacts": ["README.md", "VERDICT.md", "trigger.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt", "fix.diff", "fix_build.log", "manifest.json", "verdict.json"]
}