⬢ DragonFlyBSD Kernel Audit
DF-5326 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-5326",
  "title": "mp_bootaddress() integer underflow corrupts the kernel physical memory map",
  "file": "sys/platform/pc64/x86_64/mp_machdep.c",
  "verdict": "untested (kernel-boot manifestation) / arithmetic reproduced on guest",
  "impact": "boot-time kernel memory-map corruption from crafted firmware/boot chain; not demonstrated on guest",
  "reproduce": {
    "build": "on guest (via vm.sh run_root): echo <b64> | openssl base64 -d -A > /tmp/mpb.c && cc -O2 -Wall -Wextra -o /tmp/mpb /tmp/mpb.c   (or any host: cc -O2 -o mp_bootaddr_underflow mp_bootaddr_underflow.c)",
    "run": "/tmp/mpb  (or ./mp_bootaddr_underflow)",
    "expected": "bootMP_size = 170; basemem<=12 -> mptramp_pagetables wraps to 0xFFFFD000-0xFFFFC000 (physmap[1] ~= 4GB); basemem 13-16 -> 0x0 (PTs smash IVT/BDA); basemem>=17 sane; 638 -> 0x9c000 (real SeaBIOS value)"
  },
  "kernel_refs": [
    "sys/platform/pc64/x86_64/mp_machdep.c:206",
    "sys/platform/pc64/x86_64/mp_machdep.c:212",
    "sys/platform/pc64/x86_64/mp_machdep.c:216",
    "sys/platform/pc64/x86_64/mp_machdep.c:414",
    "sys/platform/pc64/x86_64/machdep.c:2270",
    "sys/platform/pc64/x86_64/machdep.c:2272"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "mp_bootaddr_underflow.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}