⬢ DragonFlyBSD Kernel Audit
DF-4748 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
{
  "finding_id": "DF-4748",
  "verdict": "reproduced",
  "reproduced": true,
  "impact": "memcorrupt",
  "confidence": "certain",
  "verified_with": "verbatim-code rig (DF-4165/4247/4631 evidence class); in-kernel trigger hardware-gated (no AMD ASIC on guest)",
  "reproduce": {
    "build": "sh rig/build.sh /usr/src   # on guest: slices regenerated from /usr/src, 66 blocks byte-identity-proven, builds rig_base + rig_fixed",
    "run": "sh rig/run.sh",
    "expected": "baseline disable-guard -> exit 77 'USE-AFTER-FREE CONFIRMED' inside freed amdgpu_dm_connector; disable-groom/enable-groom -> exit 77 'CONTROLLED-WRITE PROVEN' at attacker-chosen address; disable-poison -> exit 77 wild pointer; stale/zero -> exit 0 latent; fixed build -> all 8 scenarios exit 0 (FIX_CLEAN / FIX_BLOCKED_WRITE)"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:197",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:199",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:289",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:317",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:243",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:375",
    "sys/dev/drm/amd/display/dc/core/dc_sink.c:80",
    "sys/dev/drm/amd/display/dc/core/dc.c:1823",
    "sys/dev/drm/amd/display/dc/core/dc_stream.c:66",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:2454",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:2630",
    "sys/dev/drm/drm_dp_mst_topology.c:2765"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "verdict.json",
    "manifest.json",
    "env.txt",
    "fix.diff",
    "fix_build.log",
    "fix_run.log",
    "static_proof.log",
    "verify.sh",
    "rig/gen_rig.sh",
    "rig/check_verbatim.sh",
    "rig/mst_rig.c",
    "rig/rig_shims.h",
    "rig/rig_types.h",
    "rig/Makefile",
    "rig/build.sh",
    "rig/run.sh",
    "rig/build.log",
    "rig/run.log",
    "rig/run.2.log",
    "rig/run.3.log"
  ]
}