⬢ DragonFlyBSD Kernel Audit
DF-4286 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
{
  "finding_id": "DF-4286",
  "verdict": "inconclusive (source-certain lifetime defect; ThinkPad hardware absent)",
  "impact": "root-racy use-after-free of acpi_thinkpad softc via undrained AcpiOsExecute LED task on detach",
  "reproduce": {
    "build": "n/a (driver cannot attach on this guest: probe requires IBM0068/LEN0068/LEN0268)",
    "run": "on real ThinkPad hw: loop `echo 1 > /dev/led/thinklight; echo 0 > /dev/led/thinklight` while `kldunload acpi_thinkpad`",
    "expected": "kernel memory corruption / panic when thinkpad_led_task runs after softc free"
  },
  "kernel_refs": [
    "sys/dev/acpica/acpi_thinkpad/acpi_thinkpad.c:390-416",
    "sys/dev/acpica/acpi_thinkpad/acpi_thinkpad.c:634-663",
    "sys/dev/misc/led/led.c:319-340",
    "sys/kern/kern_sensors.c:238-250"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"]
}