⬢ DragonFlyBSD Kernel Audit
DF-5347 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-5347",
  "verdict": "reproduced",
  "impact": "kernel UAF with demonstrated arbitrary-call control-flow hijack (RIP control from freed memory)",
  "reproduce": {
    "build": "cd /root/busdmauaf && make -m /usr/share/mk SYSDIR=/usr/src/sys MAKEOBJDIRPREFIX=/root/obj  (COPTS+=-DPOC_TEST=1|2|3)",
    "run": "kldload ./busdmauaf_t1.ko   # t3 for the RIP-control panic",
    "expected": "destroy(queued map) -> 0 (freed while linked); spray reclaims chunk; kernel calls planted map->callback from freed memory ('*** HIJACK PROVEN ***', arg=0xbaadf00d); POC_TEST=3 -> 'Stopped at 0x414141414000'"
  },
  "kernel_refs": [
    "sys/platform/pc64/x86_64/busdma_machdep.c:645",
    "sys/platform/pc64/x86_64/busdma_machdep.c:440",
    "sys/platform/pc64/x86_64/busdma_machdep.c:1279",
    "sys/platform/pc64/x86_64/busdma_machdep.c:1408",
    "sys/platform/pc64/x86_64/busdma_machdep.c:1445",
    "sys/platform/pc64/x86_64/busdma_machdep.c:804",
    "sys/platform/pc64/x86_64/vm_machdep.c:384"
  ],
  "artifacts": [
    "busdmauaf.c", "build.sh", "run.sh", "build.log", "run.log", "panic.txt",
    "slab_corruption_panic.txt", "getmapwaiting_null_panic.txt",
    "boot.log.tests123", "dmesg_fixrun.txt", "env.txt", "fix.diff",
    "VERDICT.md", "manifest.json", "verdict.json"
  ]
}