⬢ DragonFlyBSD Kernel Audit
DF-4174 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
  "finding_id": "DF-4174",
  "verdict": "untested",
  "impact": "none",
  "reason": "hardware-gated: overflow is in the iir SIM; guest CAM buses are QEMU ata/ahci only (PoC built + executed to the gate)",
  "reproduce": {
    "build": "cc -O -Wall -o sg_overflow sg_overflow.c -lcam",
    "run": "./sg_overflow [/dev/passN-on-iir-bus]",
    "expected": "on hardware-less guest: 'SIM is not \"iir\"' exit 4 (see run.log); on iir host as root: heap overflow past gccb->gc_cmd[324] via iir.c:1271-1284"
  },
  "kernel_refs": [
    "sys/dev/raid/iir/iir.c:871",
    "sys/dev/raid/iir/iir.c:876",
    "sys/dev/raid/iir/iir.c:983",
    "sys/dev/raid/iir/iir.c:1254",
    "sys/dev/raid/iir/iir.c:1271",
    "sys/dev/raid/iir/iir.c:1283",
    "sys/dev/raid/iir/iir.h:71",
    "sys/dev/raid/iir/iir.h:243"
  ],
  "artifacts": ["README.md", "VERDICT.md", "sg_overflow.c", "gate_check.sh", "build.log", "run.log", "gate_check.log", "build_and_run.out", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}