⬢ DragonFlyBSD Kernel Audit
DF-5301 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
{
  "finding_id": "DF-5301",
  "file": "sys/bus/u4b/usb_hub.c",
  "verdict": "not_reproduced",
  "impact": "none",
  "confidence": "speculative",
  "summary": "TOCTOU NULL-deref/UAF read in uhub_child_location_string()/uhub_child_pnpinfo_string(): device_is_attached() guard (true for whole uhub_detach + ~300us tail) does not protect the sc->sc_udev->hub deref that uhub_detach() NULLs/kfrees mid-window",
  "reproduce": {
    "build": "guest: cc -O2 -pthread -o hammer hammer.c (unpriv user)",
    "run": "guest: ./hammer 10 x6 procs; host: python3 findings/poc/DF-5301/replug.py 300 0.7 0.6 with QEMU -device piix4-usb-uhci,id=uhci0 and monitor-added usb-hub+usb-tablets",
    "expected": "kernel panic 'Fatal kernel mode data access fault' in uhub_find_iface_index during a hub replug; NOT observed in 953 detach windows at ~155-190k dispatches/s (mechanics: child OID removal + non-preemptible check->deref interval close the interleaving; see VERDICT.md)"
  },
  "kernel_refs": [
    "sys/bus/u4b/usb_hub.c:1590",
    "sys/bus/u4b/usb_hub.c:1592",
    "sys/bus/u4b/usb_hub.c:1637",
    "sys/bus/u4b/usb_hub.c:1660",
    "sys/bus/u4b/usb_hub.c:1702",
    "sys/bus/u4b/usb_hub.c:2190",
    "sys/kern/subr_bus.c:1902",
    "sys/kern/subr_bus.c:2129",
    "sys/kern/subr_bus.c:3899"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "hammer.c",
    "replug.py",
    "build.sh",
    "run.sh",
    "fix.diff",
    "verdict.json",
    "manifest.json",
    "detach_count.txt",
    "hammer-tail.log",
    "boot-snippet.txt",
    "replug3.log",
    "replug4.log",
    "env.txt"
  ]
}