⬢ DragonFlyBSD Kernel Audit
DF-5124 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5124",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "hyperv_md_uninit() (hyperv_machdep.c:208-225) frees the reference-TSC DMA page at :222 with no quiesce of CPUs that may be inside the HYPERV_TSC seqlock loop using the page pointer cached at :96 - a use-after-free read window between the tc64 pointer swap (:217) and hyperv_dmamem_free (:222). The window is real by construction (no synchronization exists), but its trigger is confined to system shutdown on SMP Hyper-V guests: the file is compiled into the kernel (sys/platform/pc64/conf/files:203-205), so md_uninit runs only via SYSUNINIT (hyperv.c:331-344) at reboot, never kldunload; runtime readers are vmbus per-CPU timer interrupt code (vmbus.c:366,916). Consequence ceiling: garbage timestamps or a fault on freed/unmapped DMA memory -> panic during reboot; no unpriv trigger, no info leak (page holds only the TSC record). Cannot be exercised on the audit guest (KVM - hyperv_identify() fails, hyperv.c:207-208, code dormant) - hence untested/speculative.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5124/VERDICT.md (lifetime trace with path:line); README.md; env.txt (guest is KVM, code dormant)",
  "kernel_refs": [
    "sys/dev/virtual/hyperv/x86_64/hyperv_machdep.c:96",
    "sys/dev/virtual/hyperv/x86_64/hyperv_machdep.c:208-225",
    "sys/dev/virtual/hyperv/x86_64/hyperv_machdep.c:186-205",
    "sys/dev/virtual/hyperv/hyperv.c:296-329",
    "sys/dev/virtual/hyperv/hyperv.c:331-344",
    "sys/dev/virtual/hyperv/vmbus/vmbus.c:366",
    "sys/dev/virtual/hyperv/vmbus/vmbus.c:916",
    "sys/platform/pc64/conf/files:203-205"
  ],
  "poc_changes": "No PoC exists: requires a Hyper-V guest and a probabilistic SMP race during shutdown; the audit guest is KVM where the code never initializes.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC\t x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "7dcd208bf465e75a54167079e8b24a36b36acdf36578093cc158e26675e0973f (sha256 of README.md, the analysis artifact)",
  "notes": "Low-class teardown/lifetime finding; PoC skipped per contract (Low/Info). The cpucounter deregistration asymmetry in the same function was already noted in the pass-2 hyperv.c review and is deliberately not re-reported.",
  "recommended_fix": "Do not free the reference-TSC page at shutdown (leak one page; md_uninit is shutdown-only builtin code), or add a real cross-CPU quiesce after restoring hyperv_tc64 and before hyperv_dmamem_free (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not built: the race cannot be triggered on the KVM audit guest and is shutdown-only on real Hyper-V systems; the proposed fix (skip the free) trivially removes the window since the page outlives any in-flight reader.",
  "fix_evidence": "findings/poc/DF-5124/fix.diff"
}