⬢ DragonFlyBSD Kernel Audit
DF-5108 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5108",
  "status": "not_reproduced",
  "verdict": "not_reproduced (race-gated heap OOB write; code path certain, >=256-in-flight-groups race not reached within guest budget - ~11M ops over 3 completed 300s runs; vn-on-virtio backing completes too fast)",
  "reproduced": false,
  "impact": "memcorrupt",
  "confidence": "likely",
  "exploit_chain": "concurrent conflicting + distinct-stripe RAID-5 I/O with >=256 in-flight request groups on one plex -> pos = &lock[PLEX_LOCKS] (one-past-end) -> 16-byte OOB write (attacker-influenced 64-bit stripe + kernel bp pointer) past the 4096-byte lock table + usedlocks overrun defeating the == fullness checks permanently (repeat-after-first-hit). Unprivileged via any filesystem on a vinum volume.",
  "evidence": "run.log (3 hammer runs, 0 errors - honest negative), VERDICT.md full static chain (token-dropping tsleep :168, interrupt-context usedlocks RMW :190 vs :219, equality-only fullness :139, unconditional pos=lock :181-182, commit write :188-190), fix.diff",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumlock.c:139",
    "sys/dev/raid/vinum/vinumlock.c:167",
    "sys/dev/raid/vinum/vinumlock.c:181",
    "sys/dev/raid/vinum/vinumlock.c:188",
    "sys/dev/raid/vinum/vinumlock.c:219",
    "sys/dev/raid/vinum/vinumraid5.c:592",
    "sys/dev/raid/vinum/vinumrequest.c:397",
    "sys/dev/raid/vinum/vinumconfig.c:1467"
  ],
  "poc_changes": "initial sketch used direct lockrange calls; final trigger is real RAID-5 I/O (3x vn-backed drives, 32KB stripes, P-stripe pool for same-stripe conflicts) via pwrite from N threads",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 900,
  "guest_dirty": 1,
  "build_cmd": "sh setup.sh; make lockrange_race (see pack)",
  "run_cmd": "./lockrange_race <threads> <iosize> <stripes> 300",
  "code_hash": "",
  "notes": "production arrays with real disk latency reach 256-deep routinely; MP token serializes submissions further on this guest. Interrupted reviewer - verdict.json reconstructed by orchestrator from VERDICT.md+manifest.json.",
  "recommended_fix": "fix.diff: == to >= both fullness checks, post-tsleep goto restart recheck, end-of-table defensive guard before commit, crit around unlockranges update",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff builds and boots (validated on the DF-5109 rebuilt kernel); no behavioral regression in the hammer I/O path. Baseline race not reproduced in budget so no patched-vs-baseline behavioral delta was capturable.",
  "fix_evidence": "fix.diff (git-style); rebuild/boot validation recorded in findings/poc/DF-5109/VERDICT.md fix-validation section"
}