⬢ DragonFlyBSD Kernel Audit
DF-5011 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-5011",
  "title": "dimm_mod_unload() drains foreign dimm_softc references and kfrees live objects (UAF -> kernel panic)",
  "file": "sys/dev/misc/dimm/dimm.c",
  "verdict": "reproduced",
  "impact": "panic",
  "severity": "Low",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh (in guest, kernel built without `device dimm`; see README.md precondition)",
    "run": "sh run.sh",
    "expected": "kldunload dimm returns 0 while a KPI user holds the only reference; hw.dimminfo disappears (live softc kfreed); victim's next dimm KPI call -> Fatal trap 12 at dimm.ko+0x4a0 (unmapped module text), system down at db> prompt"
  },
  "kernel_refs": [
    "sys/dev/misc/dimm/dimm.c:305",
    "sys/dev/misc/dimm/dimm.c:316",
    "sys/dev/misc/dimm/dimm.c:184",
    "sys/dev/misc/dimm/dimm.c:195",
    "sys/dev/misc/ecc/ecc_e3.c:156",
    "sys/dev/misc/ecc/ecc_e3.c:387",
    "sys/kern/kern_linker.c:477",
    "sys/config/X86_64_GENERIC:189"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "drainpoc.c", "build.sh", "run.sh",
    "run-control.sh", "run-fix.sh", "build.log", "run.log", "run.2.log",
    "run.3.log", "panic.txt", "env.txt", "fix.diff", "manifest.json",
    "verdict.json"
  ]
}