⬢ DragonFlyBSD Kernel Audit
DF-5076 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "finding_id": "DF-5076",
  "title": "ipmi2_pci_probe is the only IPMI frontend probe lacking the ipmi_attached re-attach guard -- double attach (second cdev + second kthread) on dual-description BMC hardware",
  "verdict": "pass2_confirmed_low_static",
  "impact_class": "double driver attach -> interleaved KCS/SMIC state machines on one BMC -> stuck kernel threads (DoS-class), hardware-topology-gated",
  "kernel_refs": [
    "sys/dev/misc/ipmi/ipmi_pci.c:183-193",
    "sys/dev/misc/ipmi/ipmi_pci.c:77",
    "sys/dev/misc/ipmi/ipmi_isa.c:85",
    "sys/dev/misc/ipmi/ipmi_acpi.c:62",
    "sys/dev/misc/ipmi/ipmi.c:65",
    "sys/dev/misc/ipmi/ipmi.c:864",
    "sys/dev/misc/ipmi/ipmi.c:831",
    "sys/dev/misc/ipmi/ipmi_kcs.c:476",
    "sys/dev/misc/ipmi/ipmi_smic.c:382",
    "sys/dev/misc/ipmi/ipmi_pci.c:196-275"
  ],
  "reproduce": {
    "build": "n/a (static code-fact finding)",
    "run": "n/a -- QEMU has no PCI IPMI device model; guest has no class-0c:07 function (env.txt). See guard_matrix.log for the static proof.",
    "expected": "guard_matrix.log shows guards at ipmi_pci.c:77 / ipmi_isa.c:85 / ipmi_acpi.c:62 and their absence in ipmi2_pci_probe (:183-193)"
  },
  "artifacts": [
    "README.md", "VERDICT.md", "guard_matrix.log", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}