⬢ DragonFlyBSD Kernel Audit
DF-5049 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-5049",
  "verdict": "not_reproduced: hardware-gated",
  "impact": "none (demonstrated); source-proven kernel UAF read/write (see VERDICT.md)",
  "reproduce": {
    "build": "cc -O -o syspd_hold syspd_hold.c",
    "run": "./syspd_hold /dev/mfisyspd0",
    "expected": "hardware: fd survives MR_EVT_PD_REMOVED syspd delete, subsequent pread(2)/close(2) write into freed mfi_system_pd slab; this guest: open(2) ENOENT (no MegaRAID PCI device)"
  },
  "kernel_refs": [
    "sys/dev/raid/mfi/mfi_syspd.c:155",
    "sys/dev/raid/mfi/mfi_syspd.c:162",
    "sys/dev/raid/mfi/mfi_syspd.c:175",
    "sys/dev/raid/mfi/mfi_syspd.c:196",
    "sys/dev/raid/mfi/mfi_syspd.c:278",
    "sys/dev/raid/mfi/mfi_syspd.c:281",
    "sys/dev/raid/mfi/mfi.c:149",
    "sys/dev/raid/mfi/mfi.c:1513",
    "sys/dev/raid/mfi/mfi.c:1344",
    "sys/dev/raid/mfi/mfi.c:1950",
    "sys/dev/raid/mfi/mfi.c:1962",
    "sys/dev/raid/mfi/mfi.c:2008",
    "sys/dev/raid/mfi/mfi.c:2114",
    "sys/dev/raid/mfi/mfi_disk.c:304",
    "sys/kern/subr_bus.c:1943",
    "sys/kern/subr_disk.c:740"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "syspd_hold.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}