⬢ DragonFlyBSD Kernel Audit
DF-4977 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-4977",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "cardbus_detach_card (cardbus.c:236-247) ignores the return of device_detach (line 243) and device_delete_child (line 245) yet unconditionally pci_freecfgs the child devinfo (line 246). DFs device_delete_child returns the detach error and leaves the child in the tree (subr_bus.c:1284-1293), so a busy child (detach EBUSY) survives with child->ivars pointing at freed memory, while cardbus_release_all_resources (line 244) has already ripped its bus resources and zeroed its BARs out from under the running driver. Next touch of the surviving child (e.g. cardbus_driver_added at cardbus.c:281-287 after any driver kldload: pci_print_verbose(&dinfo->pci) read, pci_cfg_restore write) is a UAF. Untested because the trigger needs a CardBus bridge and a card event (eject/re-insert/suspend) with a busy cardbus child; the audit QEMU guest has no cbb controller at all (env.txt), so the code path cannot execute there. Defect proven by code reading; exploit chain not developed (hardware gate), hence impact recorded as none-demonstrated with the class being UAF/memcorrupt.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4977/VERDICT.md (code-path proof), README.md/trigger.md (physical trigger), env.txt (guest pciconf/kldstat proof of no cardbus hardware), fix.diff (authored, not applied to sys/)",
  "kernel_refs": [
    "sys/dev/pccard/cardbus/cardbus.c:236",
    "sys/dev/pccard/cardbus/cardbus.c:243",
    "sys/dev/pccard/cardbus/cardbus.c:244",
    "sys/dev/pccard/cardbus/cardbus.c:245",
    "sys/dev/pccard/cardbus/cardbus.c:246",
    "sys/dev/pccard/cardbus/cardbus.c:300",
    "sys/dev/pccard/cardbus/cardbus.c:281",
    "sys/kern/subr_bus.c:1284",
    "sys/kern/subr_bus.c:1292",
    "sys/bus/pci/pci.c:2139"
  ],
  "poc_changes": "No seeded PoC existed; the pack was authored from scratch as a hardware-gated trigger analysis (trigger.md). Nothing was built or run (attempts 0) because the guest lacks any cbb/CardBus controller.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "./build.sh (documentation-only; hardware-gated)",
  "run_cmd": "./run.sh (documentation-only; hardware-gated)",
  "code_hash": "",
  "notes": "Status untested used for the natural not testable on this guest case per the restricted enum for this batch. Same defect pattern fires from cardbus_suspend (cardbus.c:121-126) and the re-insert path cardbus_attach_card (cardbus.c:168). Severity Low per rubric (physical CardBus hardware required); defect class is UAF/resource-lifetime (memcorrupt bucket). Known findings DF-4690/DF-4691 (cardbus_cis.c) and DF-4738 (pccbb_pci.c) are different files and not affected by this report.",
  "recommended_fix": "Abort per-child teardown when device_detach or device_delete_child fails: keep the child and its dinfo alive and propagate the error; only pci_freecfg after the child is actually deleted (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation impossible on the audit guest for the same reason the PoC is untested (no CardBus controller; the path cannot execute). fix.diff was authored against the read-only sys/ tree from line-accurate reading and never applied there.",
  "fix_evidence": "findings/poc/DF-4977/fix.diff"
}