⬢ DragonFlyBSD Kernel Audit
DF-4326 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4326",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED on the live guest kernel via harness: sf_rxeofs unchecked 11-bit DMA-supplied endidx (if_sf.c:940) indexes the 256-entry RX buffer ring with values up to 2047; sf_newbufs stores then WROTE {mbuf ptr, 30-bit DMA addr, valid bit} at endidx=2047 -> 12,272 bytes PAST the end of the entire 40,960-byte contigmallocd sf_list_data block, verified by canary corruption with exactly the planted values. Impact classed panic (heap corruption primitive; on-hw ceiling crash..corruption). Distinct from DF-1526 (length/buffer-programming, not index).",
  "exploit_chain": "on-hw chain (not exercisable on guest): NIC DMA emits RX completion with endidx in 256..2047 -> sf_newbuf OOB-writes kernel pointer + DMA address at NIC-chosen offset past the descriptor block -> adjacent-kernel-heap corruption -> crash..privesc depending on victim object",
  "evidence": "run.log (layout facts, desc at blk+53232 = +12272 past block end, canary clobber list), build.log (gcc array-bounds static proof), sf_ring_harness.c",
  "kernel_refs": [
    "sys/dev/netif/sf/if_sf.c:940",
    "sys/dev/netif/sf/if_sf.c:947",
    "sys/dev/netif/sf/if_sf.c:953",
    "sys/dev/netif/sf/if_sf.c:892",
    "sys/dev/netif/sf/if_sfreg.h:729",
    "sys/dev/netif/sf/if_sfreg.h:659"
  ],
  "poc_changes": "shared module with DF-4325; RX path replicates desc fetch + the three sf_newbuf stores",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "cd /root/kmod/sfring && make SYSDIR=/usr/src/sys",
  "run_cmd": "kldload sf_ring_harness.ko && sysctl kern.sfrh.run=3",
  "code_hash": "0e5aaac455bdfc0bdffad6e93c39e43cfc8f47330731d7150744fce738ab41d7",
  "notes": "same module as DF-4325 (mode 3)",
  "recommended_fix": "bounds-check cur_rx->sf_endidx against SF_RX_DLIST_CNT before the descriptor dereference",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix targets sf_rxeof() executing only on AIC-6915 hardware absent from the guest",
  "fix_evidence": "fix.diff authored (endidx bounds check + resync)"
}