⬢ DragonFlyBSD Kernel Audit
DF-4229 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-4229",
  "verdict": "untested",
  "impact": "leak",
  "confidence": "certain",
  "summary": "cyapawrite() declares `int error` (cyapa.c:791) uninitialized; a zero-length write (uio_resid==0) skips the copy loop (cyapa.c:802) so `error` is read unassigned at cyapa.c:815/1054 and returned at cyapa.c:1056 - stale kernel-stack int surfaces in userland as write()'s result/errno. Syscall path has no zero-length short-circuit (sys_generic.c:506 dofilewrite -> fo_write).",
  "reproduce": {
    "build": "cc -O0 -Wall -o model_uninit_error model_uninit_error.c",
    "run": "./model_uninit_error (exact control-flow model; 3/3 poison leak). Kernel: write(fd, NULL, 0) on /dev/cyapa*",
    "expected": "model returns stack poison 0xABABABAB; kernel returns stale stack int as errno/retval"
  },
  "kernel_refs": [
    "sys/dev/smbus/cyapa/cyapa.c:791",
    "sys/dev/smbus/cyapa/cyapa.c:802",
    "sys/dev/smbus/cyapa/cyapa.c:815",
    "sys/dev/smbus/cyapa/cyapa.c:1054",
    "sys/dev/smbus/cyapa/cyapa.c:1056",
    "sys/kern/sys_generic.c:506",
    "sys/vfs/devfs/devfs_vnops.c:1366"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "model_uninit_error.c", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}