⬢ DragonFlyBSD Kernel Audit
DF-5220 / run.log
← back to finding ↓ download raw
df5220[0]: A=0xfffff8008d520a80 C=0xfffff8008d520b10 A.le_prev=0xfffff8008d520b50 C.le_next=0xfffff8008d520a80
df5220[0]: D=0xfffff8008d520a80 (reclaim of A: HIT)
df5220[0]: after LIST_REMOVE(C): D.le_next=0 D.le_prev=0xffffffff82600540
df5220[0]: VULN-WRITE PROVEN: pointer 0xffffffff82600540 written into reallocated chunk D at offset 72 after kfree(A)
df5220: mechanism demonstrated: neighbor unlink writes into freed-and-reallocated memory
df5220[0]: A=0xfffff8008d520a80 C=0xfffff8008d520b10 A.le_prev=0xfffff8008d520b50 C.le_next=0xfffff8008d520a80
df5220[0]: D=0xfffff8008d520a80 (reclaim of A: HIT)
df5220[0]: after LIST_REMOVE(C): D.le_next=0 D.le_prev=0xffffffff82600540
df5220[0]: VULN-WRITE PROVEN: pointer 0xffffffff82600540 written into reallocated chunk D at offset 72 after kfree(A)
df5220: mechanism demonstrated: neighbor unlink writes into freed-and-reallocated memory
df5220[0]: A=0xfffff8008d520a80 C=0xfffff8008d520b10 A.le_prev=0xfffff8008d520b50 C.le_next=0xfffff8008d520a80
df5220[0]: D=0xfffff8008d520a80 (reclaim of A: HIT)
df5220[0]: after LIST_REMOVE(C): D.le_next=0 D.le_prev=0xffffffff82600540
df5220[0]: VULN-WRITE PROVEN: pointer 0xffffffff82600540 written into reallocated chunk D at offset 72 after kfree(A)
df5220: mechanism demonstrated: neighbor unlink writes into freed-and-reallocated memory
df5220[0]: A=0xfffff8008d520a80 C=0xfffff8008d520b10 A.le_prev=0xfffff8008d520b50 C.le_next=0xfffff8008d520a80
df5220[0]: D=0xfffff8008d520a80 (reclaim of A: HIT)
df5220[0]: after LIST_REMOVE(C): D.le_next=0 D.le_prev=0xffffffff82600540
df5220[0]: VULN-WRITE PROVEN: pointer 0xffffffff82600540 written into reallocated chunk D at offset 72 after kfree(A)
df5220: mechanism demonstrated: neighbor unlink writes into freed-and-reallocated memory