⬢ DragonFlyBSD Kernel Audit
DF-4743 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
  "verdict": "untested",
  "impact": "none (hardware-gated; on VT82C686A hw: permanent unprivileged UAF read/write via 0666 /dev/mixerN over freed codec+softc)",
  "reproduce": {
    "build": "n/a (trigger is a driver attach failure, not a program)",
    "run": "requires VT82C686A (1106:3058) + one failure after via82c686.c:548 (dma tag/alloc/load or pcm_register), then unprivileged open+ioctl on /dev/mixer0",
    "expected": "on hw: mixer ioctls execute via_read_codec/via_write_codec over kfree'd codec/via"
  },
  "kernel_refs": [
    "sys/dev/sound/pci/via82c686.c:548",
    "sys/dev/sound/pci/via82c686.c:556",
    "sys/dev/sound/pci/via82c686.c:572",
    "sys/dev/sound/pci/via82c686.c:584",
    "sys/dev/sound/pci/via82c686.c:587",
    "sys/dev/sound/pci/via82c686.c:596",
    "sys/dev/sound/pci/via82c686.c:602",
    "sys/dev/sound/pci/via82c686.c:611",
    "sys/dev/sound/pcm/mixer.c:730",
    "sys/dev/sound/pcm/ac97.c:852"
  ],
  "artifacts": ["README.md", "VERDICT.md", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json", "DF-4116_live_repro/panic.txt", "DF-4116_live_repro/NOTES.txt"]
}