⬢ DragonFlyBSD Kernel Audit
DF-4129 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
 "finding_id": "DF-4129",
 "verdict": "reproduced",
 "impact": "panic",
 "reproduce": {
  "build": "sh /tmp/df4129/build.sh  (trigger cc + fakempu.ko); sound.ko: cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC after applying wiring_enable.diff [+ fix.diff]",
  "run": "kldload sound; kldload /tmp/fakempu.ko; su - maxx -c /tmp/seq_sync_oob",
  "expected": "vulnerable: Fatal trap 12, RIP=0, \"from seq_sync_oob at 0x0\", guest dies; fixed: survived 3 cycles, rc=0, guest up"
 },
 "kernel_refs": [
  "sys/dev/sound/midi/sequencer.c:2063",
  "sys/dev/sound/midi/sequencer.c:2122",
  "sys/dev/sound/midi/sequencer.c:2124",
  "sys/dev/sound/midi/sequencer.c:2128",
  "sys/dev/sound/midi/sequencer.c:766",
  "sys/dev/sound/midi/sequencer.c:541",
  "sys/dev/sound/midi/midi.c:1509"
 ],
 "artifacts": [
  "seq_sync_oob.c",
  "fakempu.c",
  "wiring_enable.diff",
  "fix.diff",
  "baseline_stock.log",
  "wired_load.log",
  "fakempu_load.log",
  "panic.txt",
  "run.log",
  "fix_setup.log",
  "fix_run.log",
  "build.log",
  "fix_build.log",
  "env.txt",
  "sha256.txt",
  "VERDICT.md",
  "README.md",
  "verdict.json",
  "manifest.json"
 ]
}