⬢ DragonFlyBSD Kernel Audit
DF-4147 / fix_run.2.log
← back to finding ↓ download raw
[PATCHED KERNEL - clean boot, fixed cuse.ko d921b024de4556...]
kldload cuse && /usr/bin/timeout 30 /root/cuse_krw
child: open failed: Device not configured
[+] created /dev/cuse_poc0 (mode 0666)
[+] got command 1 (CUSE_CMD_OPEN=1) data_pointer=0x0 argument=0
[-] READ_DATA from kernel 0xffffffff81144960 -> ""
[-] kernel read failed/invalid (error=-1 errno=14)
PATCHED_POC_RC=1
(no cuse_krw processes left: 0)

=> On the fixed kernel the arbitrary kernel READ via CUSE_IOCTL_READ_DATA
   returns EFAULT (errno 14) and the PoC exits 1.  The child (released with
   CUSE_ERR_OTHER) bails out cleanly - no uid=0, no kernel write executed.