DF-4433 / verdict.json
{ "finding_id": "DF-4433", "poc_id": "DF-4433", "status": "untested", "reproduced": 0, "impact": "Unkillable kernel busy-loop holding the interface serializer (SIOCGIFMEDIA path) / wedged interrupt thread (media_intr path); permanent network DoS", "confidence": "likely", "attempts": 0, "guest_uname": null, "code_hash": null, "exploit_chain": [], "evidence": "Unbounded do/while DELAY(10) polls with no retry limit under ifnet serializer and in intr context. Bounded-poll fix in finding markdown.", "kernel_refs": [ "sys/dev/netif/sln/if_sln.c:389", "sys/dev/netif/sln/if_sln.c:415", "sys/dev/netif/sln/if_sln.c:1025", "sys/dev/netif/sln/if_sln.c:1101" ], "verdict": "not_run: trigger needs SC92031 hw with wedged MII (absent in guest); unprivileged SIOCGIFMEDIA reachability of the generic dispatch demonstrated on guest (uid=1001 ifconfig media query)", "fix_status": "not_testable", "fix_baseline_reproduced": 0, "fix_patched_reproduced": 0, "fix_verdict": "not_testable: hardware-gated", "fix_evidence": "fix.diff in finding markdown" } |