⬢ DragonFlyBSD Kernel Audit
DF-5167 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5167",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Skipped per contract (Low severity, hardware-preconditioned boot-time trigger): proving it by code inspection only. bt_attach()s bus_setup_intr() failure branch (bt.c:789-794) returns without deregistering the XPT bus registered at bt.c:770 or freeing the wildcard path/sim created at bt.c:776; bt_pci_attach() (bt_pci.c:152-156) then calls bt_pci_release_resources(), which releases the port and IRQ rman records (bt_pci.c:93-98) and bt_free_softc() unloads/frees the mailbox block, CCB array, S/G maps and lockuninits bt->lock (bt.c:179-236). The still-registered SIMs btaction/btpoll closures capture the softc, so the CAM probe periphs bus scan reaches a destroyed lock, released port resources and bt->free_bt_ccbs living in bus_dmamem_free()d memory - a UAF-class teardown hazard, reachable only at boot with a real BusLogic PCI HBA whose interrupt setup fails. Not reachable on the QEMU audit guest (no such PCI device, not user-controllable). Distinct from known DF-2162/DF-2431 (parent_dmat tag leak only); sibling of dpt_pci DF-5153.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5167/VERDICT.md (full line-cited proof); bt_pci.c:152-156 -> bt_pci.c:88-100 -> bt.c:179-236 (release side); bt.c:770-794 (the branch that leaks the CAM registration); README.md for the family calibration",
  "kernel_refs": [
    "sys/dev/disk/buslogic/bt_pci.c:152",
    "sys/dev/disk/buslogic/bt_pci.c:88",
    "sys/dev/disk/buslogic/bt_pci.c:93",
    "sys/dev/disk/buslogic/bt.c:770",
    "sys/dev/disk/buslogic/bt.c:776",
    "sys/dev/disk/buslogic/bt.c:789",
    "sys/dev/disk/buslogic/bt.c:792",
    "sys/dev/disk/buslogic/bt.c:179",
    "sys/dev/disk/buslogic/bt.c:236"
  ],
  "poc_changes": "No PoC exists: the trigger requires a physical BusLogic MultiMaster PCI HBA (VID 0x104B DID 0x1040/0x0140, bt_pci.c:47-48) plus a boot-time bus_setup_intr() failure; neither can be instantiated on the QEMU guest. Static-analysis evidence pack only.",
  "attempts": 0,
  "guest_uname": "n/a (guest not used for this finding)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Verification skipped per audit contract: Low severity, hardware/boot-preconditioned, no local-user attack path. Class = operation-on-released-resource (CWE-459 family), identical shape to dpt_pci DF-5153 (Low) filed this pass. The bt glue DOES release the IRQ (so adv_pci DF-5043s variant does not apply), and the init_level ladder (bt.c:183-236 vs bt.c:625-714) fully unwinds bt_inits allocations except parent_dmat (known DF-2162/DF-2431, not re-reported).",
  "recommended_fix": "In bt_attach()s bus_setup_intr() error branch, xpt_free_path + xpt_bus_deregister + cam_sim_free under bt->lock before returning (see fix.diff), mirroring the existing xpt_create_path failure branch at bt.c:776-783.",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff authored statically against the read-only sys/ tree after line-accurate confirmation of the root cause; not built or run because the trigger hardware does not exist on the audit guest (verification was skipped for the same reason).",
  "fix_evidence": "findings/poc/DF-5167/fix.diff (git-apply-able unified diff vs sys/dev/disk/buslogic/bt.c; never applied to sys/)"
}