⬢ DragonFlyBSD Kernel Audit
DF-4895 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{
  "finding_id": "DF-4895",
  "verdict": "reproduced",
  "impact": "panic (deterministic, privileged); closed-vnode UAF window in mid-flight variant",
  "reproduce": {
    "build": "none (shell + dd + vinum(8)); fix validation: cd /usr/src && git apply fix.diff && make -j6 quickkernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC",
    "run": "sh setup_vinum.sh && sh trigger.sh",
    "expected": "unpatched: Fatal trap 12, Stopped at vn_strategy+0x38: testb $0x40,0x5c(%r13), fault address 0x5c, process dd; patched: write completes, second-phase data lands on raw md1s0 @425/@4521, roundtrip OK"
  },
  "kernel_refs": [
    "sys/dev/raid/vinum/vinuminterrupt.c:194",
    "sys/dev/raid/vinum/vinuminterrupt.c:427",
    "sys/dev/raid/vinum/vinuminterrupt.c:464",
    "sys/dev/raid/vinum/vinumstate.c:62",
    "sys/dev/raid/vinum/vinumstate.c:87",
    "sys/dev/raid/vinum/vinumstate.c:942",
    "sys/dev/raid/vinum/vinumio.c:225",
    "sys/dev/raid/vinum/vinumrequest.c:436",
    "sys/kern/vfs_bio.c:3375"
  ],
  "artifacts": ["README.md","VERDICT.md","setup_vinum.sh","writer.sh","racer.sh","run.sh","trigger.sh","run.log","run.patched.log","panic.txt","env.txt","fix.diff","fix_build.log","manifest.json","verdict.json"],
  "code_hash": "cb9fe6b5a627bdfa975548cb25d4b664059873da7c8e56119c59b14952f41965"
}