⬢ DragonFlyBSD Kernel Audit
DF-4334 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-4334",
  "manifest_version": 1,
  "file": "sys/dev/sound/pci/via8233.c",
  "title": "via_attach() pcm_register()-failure path frees the AC97 codec while mixer_init()'s 0666 /dev/mixerN survives (mixer ioctl UAF)",
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O -Wall -o /root/via8233_probe /root/via8233_probe.c",
    "run": "/root/via8233_probe; pciconf -l | grep 1106:3059; ls /dev/mixer*",
    "expected": "probe documents the absent trigger environment: no 1106:3059 function (host QEMU 7.2.22 lacks the via-ac97 device added in QEMU 8.2), no /dev/mixer nodes, snd_via8233 not loadable; the defect itself is attach-failure-gated (pcm_veto_load / unit>255) and cannot be created by an unprivileged user"
  },
  "kernel_refs": [
    "sys/dev/sound/pci/via8233.c:1335",
    "sys/dev/sound/pci/via8233.c:1354",
    "sys/dev/sound/pci/via8233.c:1372",
    "sys/dev/sound/pcm/mixer.c:730",
    "sys/dev/sound/pcm/ac97.c:852",
    "sys/dev/sound/pcm/sound.c:50",
    "sys/dev/sound/pcm/sound.c:1021",
    "sys/dev/sound/pcm/sound.c:1027",
    "sys/dev/sound/pcm/feeder.c:126",
    "sys/dev/sound/pcm/sound.h:107"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "via8233_probe.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}