⬢ DragonFlyBSD Kernel Audit
DF-4273 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-4273",
  "file": "sys/dev/raid/twa/tw_osl_freebsd.c",
  "title": "twa passthrough buffer_length unvalidated: unbounded kmalloc/copyin (DoS) and silent no-payload wrap; wrap-to-undersize heap-overflow theory empirically refuted",
  "verdict": "inconclusive",
  "impact": "none-observed",
  "reproduce": {
    "build": "cc -O2 -o /tmp/twa_roundup2_overflow /tmp/twa_roundup2_overflow.c",
    "run": "/tmp/twa_roundup2_overflow",
    "expected": "table of kmalloc-vs-copyin sizes: no bound for any length incl. 0x7FFFFFFF; lengths >= 0xFFFFFE01 wrap roundup2() to 0 (no-payload path); open(\"/dev/twa0\") = ENOENT on the audit guest (no 3ware hardware)"
  },
  "kernel_refs": [
    "sys/dev/raid/twa/tw_osl_freebsd.c:927",
    "sys/dev/raid/twa/tw_osl_freebsd.c:930",
    "sys/dev/raid/twa/tw_osl_freebsd.c:933",
    "sys/dev/raid/twa/tw_osl_freebsd.c:1031",
    "sys/dev/raid/twa/tw_cl_ioctl.h:96",
    "sys/dev/raid/twa/tw_cl_share.h:72",
    "sys/sys/param.h:403"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "twa_roundup2_overflow.c",
    "build.sh", "run.sh", "build.log", "run.log", "env.txt",
    "fix.diff", "manifest.json", "verdict.json"
  ]
}