⬢ DragonFlyBSD Kernel Audit
DF-4317 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-4317",
  "file": "sys/dev/netif/lge/if_lge.c",
  "verdict": "hardware-gated-untested",
  "impact": "same-slot double ownership of a 9KB RX jumbo cluster: cross-packet data bleed, freelist corruption / panic (local DoS ceiling) on lge hardware",
  "reproduce": {
    "build": "n/a (no runtime PoC possible: guest has no LGE NIC)",
    "run": "on lge hardware: drive RX through the NIC while concurrently copying/freeing received jumbo frames (e.g. tcpdump/BPF + heavy RX on a >=2 CPU box) and watch for 'lge_jfree: buffer already free!' panic or packet data corruption",
    "expected": "n/a on this guest; source interleaving proven by inspection (see VERDICT.md)"
  },
  "kernel_refs": [
    "sys/dev/netif/lge/if_lge.c:685",
    "sys/dev/netif/lge/if_lge.c:801",
    "sys/dev/netif/lge/if_lge.c:810",
    "sys/dev/netif/lge/if_lge.c:813",
    "sys/dev/netif/lge/if_lge.c:819",
    "sys/dev/netif/lge/if_lge.c:833",
    "sys/dev/netif/lge/if_lge.c:834",
    "sys/dev/netif/lge/if_lge.c:836",
    "sys/dev/netif/lge/if_lge.c:777"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"
  ]
}