⬢ DragonFlyBSD Kernel Audit
DF-4777 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4777",
  "verdict": "reproduced / leak",
  "impact": "kernel-heap OOB read (info leak) to operator-group userspace, hostile-BMC precondition",
  "reproduce": {
    "build": "guest: (cd /root/bumpko && make); cc -O2 -o /tmp/leak leak.c; kldload bumpko.ko",
    "run": "run_user: nohup /tmp/leak > /tmp/leak.out & ; 11s later run_root: sysctl hw.bumpreplylen=16000 ; cat /tmp/leak.out",
    "expected": "baseline: msg.data_len=16001, ~7136 nonzero bytes beyond offset 1024 incl. kernel slab pointers + 424 marker fragments (3/3); control (arm=200): nothing beyond; patched (fix.diff): msg.data_len=1025, 0 beyond"
  },
  "kernel_refs": [
    "sys/dev/misc/ipmi/ipmi_kcs.c:411-432",
    "sys/dev/misc/ipmi/ipmi.c:448-468",
    "sys/dev/misc/ipmi/ipmi.c:534-546",
    "sys/dev/misc/ipmi/ipmi_smic.c:341"
  ],
  "artifacts": [
    { "path": "leak.c", "type": "trigger", "desc": "unprivileged groom+victim+RECEIVE PoC (operator group)" },
    { "path": "bumpko.c", "type": "trigger", "desc": "root KLD substituting the hostile-BMC transport end-state (QEMU sim caps replies at 255)" },
    { "path": "build.sh", "type": "build", "desc": "exact build commands" },
    { "path": "run.sh", "type": "run", "desc": "exact run sequence + expectations" },
    { "path": "build.log", "type": "log", "desc": "module build output" },
    { "path": "run.log", "type": "log", "desc": "baseline reproduction 1 (full output)" },
    { "path": "run.2.log", "type": "log", "desc": "baseline reproduction 2" },
    { "path": "run.3.log", "type": "log", "desc": "baseline reproduction 3" },
    { "path": "run.control.log", "type": "log", "desc": "control: legal 200-byte reply -> no over-read" },
    { "path": "leak_sample.txt", "type": "evidence", "desc": "leaked kernel pointers + marker pattern, 3-run profile" },
    { "path": "fix.diff", "type": "suggested-fix", "desc": "kcs+smic collection clamp + ipmi.c sink clamp (validated live)" },
    { "path": "fix_build.log", "type": "log", "desc": "patched-kernel nativekernel build (BUILD-OK)" },
    { "path": "fix_run.log", "type": "log", "desc": "patched-kernel decisive run: data_len=1025, 0 beyond" },
    { "path": "env.txt", "type": "env", "desc": "guest environment (baseline kernel)" },
    { "path": "VERDICT.md", "type": "verdict", "desc": "full narrative incl. transport-substitution caveat + geometry" },
    { "path": "manifest.json", "type": "manifest", "desc": "this file" },
    { "path": "verdict.json", "type": "verdict", "desc": "machine verdict" }
  ]
}