⬢ DragonFlyBSD Kernel Audit
DF-4646 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-4646",
  "title": "nvme(4) teardown vs in-flight data-path I/O: UAF -> div0 panic",
  "verdict": "reproduced / panic / certain",
  "impact": "panic",
  "reproduce": {
    "build": "sh build.sh  (in guest; nvme guest via dfbsd-qemu/vm_nvme.sh)",
    "run": "sh run.sh",
    "expected": "Fatal trap 18 ... Stopped at nvme_get_request+0x34: divl 0x40(%r13),%eax; DDB prompt; ssh dead"
  },
  "kernel_refs": [
    "sys/dev/disk/nvme/nvme_disk.c:115",
    "sys/dev/disk/nvme/nvme_disk.c:172",
    "sys/dev/disk/nvme/nvme_disk.c:189",
    "sys/dev/disk/nvme/nvme_disk.c:379",
    "sys/dev/disk/nvme/nvme_disk.c:394",
    "sys/dev/disk/nvme/nvme_attach.c:470",
    "sys/dev/disk/nvme/nvme_admin.c:110",
    "sys/dev/disk/nvme/nvme_admin.c:185",
    "sys/dev/disk/nvme/nvme.c:446"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "nvio.c", "nvzombie.c", "nvmebang.c",
    "build.sh", "run.sh", "build.log", "base_build.log", "run.log",
    "panic.txt", "fix.diff", "env.txt", "hashes.txt", "verdict.json",
    "manifest.json"
  ]
}