⬢ DragonFlyBSD Kernel Audit
DF-4903 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "finding_id": "DF-4903",
  "title": "Uninitialised heap read in k8_powernow_setperf tail leaks a heap word into world-readable sysctl machdep.powernow.frequency.current",
  "verdict": "untested",
  "impact": "leak",
  "confidence": "likely",
  "reproduce": {
    "build": "cc -Wall -O2 -o sim_tailread sim_tailread.c",
    "run": "./sim_tailread",
    "expected": "cpuspeed after init = 0xa5a5a5a5 — the uninitialised state_table[n_states] word lands in cpuspeed, exposed to any local user via sysctl machdep.powernow.frequency.current (kernel path itself requires AMD K8 + boot fid/vid not in the decoded PST; audit guest is Intel/QEMU where the module gate refuses at CPUID, error 2)"
  },
  "kernel_refs": [
    "sys/dev/powermng/powernow/powernow.c:223",
    "sys/dev/powermng/powernow/powernow.c:227",
    "sys/dev/powermng/powernow/powernow.c:246",
    "sys/dev/powermng/powernow/powernow.c:310",
    "sys/dev/powermng/powernow/powernow.c:311",
    "sys/dev/powermng/powernow/powernow.c:366",
    "sys/dev/powermng/powernow/powernow.c:392",
    "sys/dev/powermng/powernow/powernow.c:417",
    "sys/kern/kern_sysctl.c:1446"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "sim_tailread.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}