⬢ DragonFlyBSD Kernel Audit
DF-5062 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{
  "finding_id": "DF-5062",
  "verdict": "reproduced",
  "impact": "data corruption (cross-volume) / wrong-object sizing; root-gated",
  "confidence": "certain",
  "reproduce": {
    "build": "(no compilation) push label.bin + df5062_volalias.sh + alias2.sh to the guest",
    "run": "kldload vinum; sh /tmp/df5062_volalias.sh; sh /tmp/alias2.sh",
    "expected": "vulnerable: /dev/vinum/vol/v256 exists (rdev 255,0xffff00ff), diskinfo v256 = v0's 4.00 MB, BBBB written via v256 reads back via v0. patched: 'volume number 256 does not fit' log, no v256 node (ENOENT), v0 data intact."
  },
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumconfig.c:759-774",
    "sys/dev/raid/vinum/vinumutil.c:238-242",
    "sys/dev/raid/vinum/vinumvar.h:83-86",
    "sys/dev/raid/vinum/vinumvar.h:113-116",
    "sys/kern/kern_conf.c:70-75"
  ],
  "artifacts": [
    "df5062_volalias.sh", "alias2.sh", "run.sh", "run.log", "run.2.log",
    "build.log", "fix.diff", "fix_build.log", "fix_run.log", "fix_run2.log",
    "env.txt", "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}