⬢ DragonFlyBSD Kernel Audit
DF-5001 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5001",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED: miibus_mediainit (mii.c:227-245) ends in an unconditional ifmedia_set(&mii->mii_media, media) (mii.c:244); on an EMPTY media list the walk (mii.c:238-243) never runs, media stays 0 (mii.c:232), and DragonFlys ifmedia_set() executes panic(\"ifmedia_set\") (sys/net/if_media.c:174). A KLD replaying the hub walk verbatim against a real struct ifmedia (state = every probed PHY took its no media present branch: atphy DF-4930 / ciphy DF-4957 / jmphy DF-4981 / truephy DF-5003, parent NIC added nothing) panicked the running guest exactly as predicted (ifmedia_set: no match for 0x0/0xfffffff -> panic, trace ifmedia_set<-miihub_fire<-sysctl) and the guest went down (panic.txt); the fixed walk (fix.diff: empty list -> ifmedia_add(IFM_ETHER|IFM_AUTO) -> ifmedia_set) survived the identical scenario with ifm_cur non-NULL (run.2.log), and the patched mii.c compiles clean under -Werror (fixcheck-build.log). End-to-end trigger is hardware-preconditioned (a PHY that passes the BMSR probe at mii.c:113-115 but reports zero media capabilities at driver attach), i.e. attach/boot-time DoS on faulty or malicious hardware-in-the-loop -- same class as the family leaves (all Low); no memory unsafety, no escalation angle. This hub guard is the family-wide fix and the ONLY one covering the MIIF_NOISOLATE drivers ciphy and truephy, for whom the mii_phy_add_media IFM_NONE fallback is gated off (mii_physubr.c:230-232).",
  "exploit_chain": "",
  "evidence": "panic.txt (serial console: ifmedia_set: no match for 0x0/0xfffffff -> panic: ifmedia_set -> trace ifmedia_set<-miihub_fire<-sysctl_root<-userland_sysctl<-sys___sysctl; vm.sh status=down right after), run.log (baseline, ssh died at panic), run.2.log (fixcheck: miihub-fix: survived; ifm_cur=0xfffff8008d481d60 media=0x20 + ifm_cur->ifm_media=0x20 (service deref safe), guest up), build.log (clean -Werror KLD build), fixcheck-build.log (patched mii.c compiles as KLD source), fix.diff (git-apply-able, verified), VERDICT.md (full narrative)",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/mii.c:227-245",
    "sys/dev/netif/mii_layer/mii.c:232",
    "sys/dev/netif/mii_layer/mii.c:238-244",
    "sys/net/if_media.c:166-174",
    "sys/dev/netif/mii_layer/mii_physubr.c:230-232",
    "sys/dev/netif/mii_layer/truephy.c:171-175",
    "sys/dev/netif/mii_layer/ciphy.c:132",
    "sys/dev/netif/mii_layer/truephy.c:157"
  ],
  "poc_changes": "PoC authored fresh (no seed). Two build iterations: the generated-interface headers (device_if.h/bus_if.h) are absent from the guest /sys after vm.sh reset with-src, so the Makefile needed SRCS+= device_if.h bus_if.h (kmod.mks makeobjops.awk rules generate them). Baseline run killed the guest before ssh could flush; decisive output captured from the serial console (vm.sh log).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 620,
  "guest_dirty": 1,
  "build_cmd": "guest /root/df5001: make -m /usr/share/mk   (pack: sh build.sh)",
  "run_cmd": "guest: kldload /root/df5001/miihub.ko; sysctl hw.miihub_fire=1  [baseline panic] / sysctl hw.miihub_fixcheck=1  [fixcheck]   (pack: sh run.sh / sh run_fix.sh)",
  "code_hash": "c49d24231cc363d3daa1c8ef53d62829b28de8ed9cbda93ba9cfe8870ef44cc6",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (miibus_mediainit: empty list -> ifmedia_add(IFM_ETHER|IFM_AUTO) before ifmedia_set) could not be exercised through the real in-kernel miibus_mediainit on this guest (no miibus-attached NIC exists in QEMU, so the real code path cannot be driven end-to-end). Its operative mechanism WAS validated on the running kernel: the identical empty-list scenario replayed through the FIXED walk survives with ifm_cur non-NULL and ifm_cur->ifm_media=0x20 (run.2.log), and the patched mii.c itself compiles clean under -Werror as a KLD source (fixcheck-build.log).",
  "fix_evidence": "run.2.log (miihub-fix: survived; ifm_cur=0xfffff8008d481d60 media=0x20), fixcheck-build.log (miifix.ko linked from patched mii.c), fix.diff (applies cleanly: git apply --check OK)",
  "notes": "Hub of the DF-4930/DF-4957/DF-4981 empty-media family; DF-5003 (truephy) is the 4th leaf. Pass-2 insight: the family leaf-fix pattern call mii_phy_add_media unconditionally is a NO-OP for ciphy and truephy because they set MIIF_NOISOLATE (ciphy.c:132, truephy.c:157) and the IFM_NONE fallback in mii_phy_add_media is gated on MIIF_NOISOLATE being clear (mii_physubr.c:230-232) -- the hub guard is the only fix that covers them. Panic is deterministic DoS only; no write primitive, no uid=0 route.",
  "recommended_fix": "miibus_mediainit: if the media list is empty after the parent poke, ifmedia_add(IFM_ETHER|IFM_AUTO) before ifmedia_set() (fix.diff) -- fixes the whole family in one place, including the MIIF_NOISOLATE drivers."
}