⬢ DragonFlyBSD Kernel Audit
DF-5203 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-5203",
  "verdict": "untested",
  "impact": "none",
  "reproduce": {
    "build": "static code-fact finding: grep -n ipmi_attached sys/dev/misc/ipmi/{ipmi_pci,ipmi_isa,ipmi_acpi,ipmi_smbus}.c ; git apply --check findings/poc/DF-5203/fix.diff",
    "run": "runtime construction impossible on this guest (no smbus bus, no SMBIOS type-38; see env.txt for the live kldload ipmi demonstration)",
    "expected": "guard present at ipmi_pci.c:77 / ipmi_isa.c:85 / ipmi_acpi.c:62, ABSENT at ipmi_smbus.c:65-71 (and at DF-5076's ipmi_pci.c:183-193); on SSIF firmware with >=2 smbus buses a second ipmi device attaches (2nd ssif_loop kthread, 2nd /dev/ipmiN, 2nd watchdog callout, interleaved SSIF block transactions to one BMC)"
  },
  "kernel_refs": [
    "sys/dev/misc/ipmi/ipmi_smbus.c:65-71",
    "sys/dev/misc/ipmi/ipmi_smbus.c:55-63",
    "sys/dev/misc/ipmi/ipmi_pci.c:77-78",
    "sys/dev/misc/ipmi/ipmi_isa.c:85-86",
    "sys/dev/misc/ipmi/ipmi_acpi.c:62-63",
    "sys/dev/misc/ipmi/ipmi.c:65",
    "sys/dev/misc/ipmi/ipmi.c:841-866",
    "sys/dev/misc/ipmi/ipmi.c:831",
    "sys/dev/misc/ipmi/ipmi_ssif.c:361-374",
    "sys/dev/misc/ipmi/ipmi_ssif.c:314-351",
    "sys/dev/misc/ipmi/ipmi_acpi.c:104-109"
  ],
  "artifacts": [
    "guard_matrix.log",
    "env.txt",
    "fix.diff",
    "VERDICT.md",
    "README.md",
    "manifest.json",
    "verdict.json"
  ]
}