⬢ DragonFlyBSD Kernel Audit
DF-4506 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-4506",
  "title": "i915_gem_context unlocked IDR lookups race idr_grow kfree of the node array (no RCU on DragonFly) -> UAF read -> attacker-influenced context pointer",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "guest: cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC (with amplifier.diff [+ fix.diff for the patched run]); cd /root/idr_race && make SYSDIR=/usr/src/sys",
    "run": "kldload /root/idr_race/idr_race.ko; sysctl debug.idr_find_pause=3; sysctl debug.idr_race.run=20; sysctl debug.idr_race.captures  (expect CAPTURE lines / captures>0 unfixed, 0 fixed); native: sysctl debug.idr_find_pause=0; sysctl debug.idr_race.run=-500 (unfixed: kernel panics in idr_find+0x48 within a few rounds)",
    "expected": "unfixed: canary captures amplified (20/20, 9/10) + native kernel panic; patched: 0 captures, no panic across 1.6M finds"
  },
  "kernel_refs": [
    "sys/dev/drm/i915/i915_gem_context.c:831",
    "sys/dev/drm/i915/i915_gem_context.c:855",
    "sys/dev/drm/i915/i915_gem_context.c:901",
    "sys/dev/drm/i915/i915_gem_context.c:981",
    "sys/dev/drm/i915/i915_gem_context.c:355",
    "sys/libkern/linux_idr.c:515-528",
    "sys/libkern/linux_idr.c:449-459",
    "sys/dev/drm/include/linux/rcupdate.h:46-56",
    "sys/dev/drm/linux_rcu.c:161-184"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "idr_race.c", "Makefile", "amplifier.diff",
    "fix.diff", "build.sh", "run.sh", "build.log", "run.log",
    "run.fixed.log", "panic.txt", "env.txt", "verdict.json", "manifest.json"
  ]
}