DF-4483 / verdict.json
{ "finding_id": "DF-4483", "poc_id": "DF-4483", "status": "untested", "reproduced": 0, "impact": "Latent heap double-free/UAF landmine (dead today: Malloc is M_WAITOK and never fails)", "confidence": "certain", "attempts": 0, "guest_uname": null, "code_hash": null, "exploit_chain": [], "evidence": "Mixed ownership between abortrequest-freerq and the callers ENOMEM cleanup. Drop-the-abortrequest fix in finding markdown.", "kernel_refs": [ "sys/dev/raid/vinum/vinumrequest.c:833", "sys/dev/raid/vinum/vinumrequest.c:838" ], "verdict": "not_run: allocation cannot fail on stock kernels; immediate double-free the day any Malloc in this path switches to M_NOWAIT", "fix_status": "not_testable", "fix_baseline_reproduced": 0, "fix_patched_reproduced": 0, "fix_verdict": "not_testable", "fix_evidence": "fix in finding markdown" } |