⬢ DragonFlyBSD Kernel Audit
DF-5175 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-5175",
  "finding_title": "CIS-controlled PCMCIA I/O window size drives out-of-allocation port I/O in ata_pccard_attach()",
  "file": "sys/dev/disk/nata/ata-card.c",
  "verdict": "untested",
  "impact_assessment": "Low — hardware-gated (physical malicious PCMCIA card); out-of-allocation 1-byte port reads/writes adjacent to the card window; no kernel memory access",
  "reproduce": {
    "build": "n/a — trigger is card attribute memory (CIS), not a program; see cis_window_trace.md for reference CIS geometry",
    "run": "insert crafted 16-bit PCMCIA disk-function card with CFE IO window length 9..14 (or 1..7) into a real slot; observe outb at window_base+14 outside the programmed bridge window",
    "expected": "control/status port I/O outside the rman allocation (logic analyzer / IO trap); no panic, no kernel memory effect"
  },
  "kernel_refs": [
    "sys/dev/disk/nata/ata-card.c:93-96",
    "sys/dev/disk/nata/ata-card.c:103-106",
    "sys/dev/disk/nata/ata-card.c:87-90",
    "sys/dev/disk/nata/ata-card.c:63-67",
    "sys/bus/pccard/pccard.c:429-449",
    "sys/bus/pccard/pccard.c:1121-1149",
    "sys/bus/pccard/pccard_cis.c:1074-1092",
    "sys/dev/disk/nata/ata-all.c:723-735",
    "sys/dev/disk/nata/ata-all.h:679-712",
    "sys/dev/disk/nata/ata-all.h:95"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "cis_window_trace.md",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}