⬢ DragonFlyBSD Kernel Audit
DF-5333 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-5333",
  "title": "chdone() CH_CCB_PROBE reads and prints uninitialized stack announce_buf[80] when cherror() returns 0 for a non-CAM_REQ_CMP completion (SCSI INTERMED / RECOVERED ERROR)",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /root/df5333 && sh build.sh",
    "run": "cd /root/df5333 && sh run.sh",
    "expected": "after '[EVILCH] MODE SENSE page 0x1d -> INTERMED (error==0 path)', the attach announce block ends with a garbage 'ch0: <uninitialized stack bytes>' line printed via %s (observed: ' x^NO', 0xB0 0x72 0x8E..., 0xC0 0x60 0x1B...); patched kernel: no announce block at all after INTERMED"
  },
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_ch.c:541",
    "sys/bus/cam/scsi/scsi_ch.c:549-573",
    "sys/bus/cam/scsi/scsi_ch.c:574-637",
    "sys/bus/cam/scsi/scsi_ch.c:639-640",
    "sys/bus/cam/cam_periph.c:1313-1318",
    "sys/bus/cam/cam_periph.c:1509-1513",
    "sys/bus/cam/cam_xpt.c:1761-1763"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "evilcd3.c", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "fixedA.log", "env.txt",
    "fix.diff", "manifest.json", "verdict.json"
  ]
}