⬢ DragonFlyBSD Kernel Audit
DF-4276 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
  "finding_id": "DF-4276",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "NOT REPRODUCED at runtime (guest has no CardBus bridge; the UAF requires real hardware + detach timing). The finding stands source-certain on its ordering axis: cbb_detach (pccbb.c:285) deletes the cardbus/pccard children while cbb_event_thread is still live and re-checking the socket every second (pccbb.c:479-484), so cbb_insert/cbb_removal reach CARD_ATTACH_CARD/CARD_DETACH_CARD/exca_insert/exca_removal on freed device_ts (pccbb.c:509,517,536-539); child detachs 10-400ms sleeps make the window seconds wide under kldunload -f. Two candidate hang axes were DISPROVEN on the guest: (a) lost final wakeup \u2014 lwkt_switch_return() unconditionally wakes sleepers on an exiting threads ident (kern/lwkt_thread.c:884-899), so tsleep(sc->event_thread) is always rescued (replica run.log); (b) flags RMW losing CBB_KTHREAD_DONE \u2014 impossible by program order. The RUNNING-flag startup window (set at pccbb.c:431 after kthread_create, pccbb_pci.c:405) remains as a narrower secondary race.",
  "exploit_chain": "",
  "evidence": "run.log (forced lost-wakeup interleaving still returns: detach COMPLETED -- no lost wakeup); VERDICT.md (full three-axis analysis); source refs pccbb.c:285,294-299,431,460,479-484,486-487,509,517,536-541,1246,1253,914-925; pccbb_pci.c:405.",
  "kernel_refs": [
    "sys/dev/pccard/pccbb/pccbb.c:285",
    "sys/dev/pccard/pccbb/pccbb.c:294",
    "sys/dev/pccard/pccbb/pccbb.c:295",
    "sys/dev/pccard/pccbb/pccbb.c:431",
    "sys/dev/pccard/pccbb/pccbb.c:460",
    "sys/dev/pccard/pccbb/pccbb.c:479",
    "sys/dev/pccard/pccbb/pccbb.c:486",
    "sys/dev/pccard/pccbb/pccbb.c:509",
    "sys/dev/pccard/pccbb/pccbb.c:517",
    "sys/dev/pccard/pccbb/pccbb.c:536",
    "sys/dev/pccard/pccbb/pccbb.c:541",
    "sys/dev/pccard/pccbb/pccbb_pci.c:405",
    "sys/kern/lwkt_thread.c:884"
  ],
  "poc_changes": "Replica authored from scratch. First build GPFd for an unrelated module-convention reason (DECLARE_MODULE needs a moduledata_t variable on current DFly, not the handler function) \u2014 fixed; guest kernel rebuilt from the audit tree (see DF-4275). The replicas DELAY-based forcing of the wakeup window worked first try once buildable.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Sat Sep 19 02:43:14 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/df4276 && make",
  "run_cmd": "kldload /usr/src/df4276/df4276rep.ko; sleep 7; dmesg | grep df4276",
  "code_hash": "b8fb1d2393053a0e0c15df980c833c392e6ee64ed3436e380c68373fc34abcc8",
  "notes": "The runtime portion of this pack is a NEGATIVE result (hang axis disproven) \u2014 valuable because it retroactively rules out the cbbun lost-wakeup class for this teardown. The surviving UAF ordering defect is Low severity (privileged detach / physical hot-removal + card present). Guest reset to with-src snapshot afterwards.",
  "recommended_fix": "Stop the event thread before device_delete_children and clear sc->cbdev/sc->exca[0].pccarddev afterwards (see fix.diff).",
  "fix_status": "untested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (reorder cbb_detach: thread stop before children deletion; NULL the child pointers). Not buildable/testable on this guest: no CardBus bridge exists, so neither baseline nor patched behavior can be exercised at driver level.",
  "fix_evidence": "findings/poc/DF-4276/fix.diff"
}