⬢ DragonFlyBSD Kernel Audit
DF-4749 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-4749",
  "verdict": "reproduced",
  "impact": "none",
  "severity": "Low",
  "confidence": "certain",
  "summary": "pt_prison is never assigned, so nmdmopen()'s prison guard (nmdm.c:211) is inert for unjailed users, degenerates to unconditional EBUSY for jailed openers (same-jail reopen impossible), and never pins a pair to its opening prison — an unprivileged host user can attach to an nmdm half held open by a jail.",
  "reproduce": {
    "build": "cc -O -Wall -o /tmp/nmdm_probe nmdm_probe.c && cc -O -o /tmp/holder holder.c",
    "run": "./run.sh",
    "expected": "baseline module: same-jail open#1 -> 'Device busy' (EBUSY) while the same jail holds the half; unprivileged unjailed open of the jail-held half -> succeeds. Patched module: same-jail reopen allowed, cross-prison attach -> 'Device busy'."
  },
  "kernel_refs": [
    "sys/dev/misc/nmdm/nmdm.c:88",
    "sys/dev/misc/nmdm/nmdm.c:126",
    "sys/dev/misc/nmdm/nmdm.c:211",
    "sys/kern/kern_prot.c:1223",
    "sys/kern/kern_jail.c:154"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "nmdm_probe.c", "holder.c", "build.sh", "run.sh",
    "run.log", "jailtest_baseline.log", "env.txt", "fix.diff", "fix_build.log",
    "fix_run.log", "manifest.json", "verdict.json"
  ]
}