⬢ DragonFlyBSD Kernel Audit
DF-4483 / verdict.json
← back to finding ↓ download raw
{
  "finding_id": "DF-4483",
  "poc_id": "DF-4483",
  "status": "untested",
  "reproduced": 0,
  "impact": "Latent heap double-free/UAF landmine (dead today: Malloc is M_WAITOK and never fails)",
  "confidence": "certain",
  "attempts": 0,
  "guest_uname": null,
  "code_hash": null,
  "exploit_chain": [],
  "evidence": "Mixed ownership between abortrequest-freerq and the callers ENOMEM cleanup. Drop-the-abortrequest fix in finding markdown.",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumrequest.c:833",
    "sys/dev/raid/vinum/vinumrequest.c:838"
  ],
  "verdict": "not_run: allocation cannot fail on stock kernels; immediate double-free the day any Malloc in this path switches to M_NOWAIT",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable",
  "fix_evidence": "fix in finding markdown"
}