⬢ DragonFlyBSD Kernel Audit
DF-4691 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4691",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "REPRODUCED at decoder level on the DragonFly guest (verbatim-extracted decode_tuple_funce, cardbus_cis.c:257-290). The LAN-NID copy length is validated only against sizeof(nid)=6 (:278), never against the tuples actual length: a 2-byte FUNCE tuple {TPLFE_TYPE_LAN_NID, 6} passes and bcopy(:282-283) reads tupledata[2..7] -- past the tuple payload -- into dinfo->funce.lan.nid, the cards Ethernet MAC ivar (PCI_IVAR_ETHADDR, cardbus.c:327-333). tupledata is the shared 0x400 parse buffer (bzero once at :656, then overwritten per tuple): demonstrated nid = e2:e3:e4:e5:e6:e7 fabricated from a PREVIOUS tuples stale bytes. No kernel-memory disclosure (contents always card-supplied/zero) -- Info/hardening. Separately fepresent |= 1<<type (:286) with type<=255 is UB (x86 masks to 1<<8: 0x110 observed). Hardware-gated (physical CardBus card).",
  "exploit_chain": "malicious CardBus card (physical insertion) -> cardbus_do_cis -> decode_tuple_bar/decode_tuple_funce -> negative resource count / stale-byte MAC ivar; no uid0 path",
  "evidence": "run.log: nid (PCI_IVAR_ETHADDR, cardbus.c:333) = e2:e3:e4:e5:e6:e7 + REPRODUCED: nid = stale bytes ... read past the 2-byte tuple at :282 + fepresent after 1<<200 (UB ...) = 0x110; fix_run.log: PATCHED mode 4 ... nid = 00:00:00:00:00:00 ... fepresent = 0x0.",
  "kernel_refs": [
    "sys/dev/pccard/cardbus/cardbus_cis.c:278",
    "sys/dev/pccard/cardbus/cardbus_cis.c:282",
    "sys/dev/pccard/cardbus/cardbus_cis.c:286",
    "sys/dev/pccard/cardbus/cardbus_cis.c:656",
    "sys/dev/pccard/cardbus/cardbus.c:333"
  ],
  "poc_changes": "verbatim extraction of the two decoder bodies (anchors, cardbus_cis.c:258-290/293-385) against minimal newbus/pci stubs (pci_read/write_config probe emulation, resource_list_add capture); added errno.h include after first build failed on EINVAL",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cd /root/cb4690 && sh build.sh",
  "run_cmd": "cd /root/cb4690 && sh run.sh",
  "code_hash": "b662d9d7a366c595e7eb6d018c7f15ec865f1c17fea6bdac58ce1715e454be3e",
  "notes": "hardware-gated (no CardBus bridge on guest); decoder-level verification per the accepted DF-1811 source-only reproduced standard",
  "recommended_fix": "Require the NID length to equal the tuple payload length (tupledata[1] == len-2) and guard the fepresent shift with type < 32.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Harness-level: baseline nid = stale 0xE2.. bytes; with fix4691.diff the mismatched tuple is ignored (nid stays zeroed) and 1<<200 no longer sets any bit (fepresent 0x0).",
  "fix_evidence": "run.log: nid (PCI_IVAR_ETHADDR, cardbus.c:333) = e2:e3:e4:e5:e6:e7 + REPRODUCED: nid = stale bytes ... read past the 2-byte tuple at :282 + fepresent after 1<<200 (UB ...) = 0x110; fix_run.log: PATCHED mode 4 ... nid = 00:00:00:00:00:00 ... fepresent = 0x0."
}