⬢ DragonFlyBSD Kernel Audit
DF-5191 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding": "DF-5191",
  "title": "sio_pccard_detach mutates softc state and frees com->ibuf without tty_token, racing siopen/sioclose/siosetwater into UAF/double-free",
  "verdict": "not_reproduced (guest has no pccard hardware; race proven by lock-protocol code trace)",
  "impact": "kernel heap UAF / double-free (M_DEVBUF) on card eject racing tty open/close",
  "confidence": "likely",
  "reproduce": {
    "build": "cc -O2 -o race_harness race_harness.c",
    "run": "./race_harness /dev/ttyd0 & ; root: pccardc power off/on loop (REQUIRES real pccard serial hardware - absent from the audit guest)",
    "expected": "kernel panic / M_DEVBUF double-free diagnostics"
  },
  "kernel_refs": [
    "sys/dev/serial/sio/sio_pccard.c:117-143",
    "sys/dev/serial/sio/sio.c:1273",
    "sys/dev/serial/sio/sio.c:1277",
    "sys/dev/serial/sio/sio.c:1460",
    "sys/dev/serial/sio/sio.c:1475-1482",
    "sys/dev/serial/sio/sio.c:2438-2446",
    "sys/kern/tty.c:247-268"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "race_harness.c",
    "fix.diff",
    "verdict.json",
    "manifest.json",
    "env.txt"
  ]
}