⬢ DragonFlyBSD Kernel Audit
DF-5363 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-5363",
  "status": "reproduced",
  "verdict": "REPRODUCED at the verbatim-rig level on the DragonFly guest; kernel entry hardware-gated (no PCMCIA bridge). The CISTPL_CHECKSUM handler validates addr and addr+length against PCCARD_CIS_SIZE in TUPLE-INDEX units (pccard_cis.c:247-249) but then reads bus_space_read_1(memt, memh, addr + tuple.mult * i) (pccard_cis.c:255-259) -- in attribute memory (mult=2, the primary-chain default at :145) the maximum byte offset is addr + 2*(length-1). On the verbatim parser, a card supplying offset=4, length=4091 passes the unmagnified check (4+4091=4095<4096) and produces EXACTLY the claimed 2045 out-of-mapping reads with maximum offset 8184 = 2.00x the 4096-byte mapping allocated at :62/:130-131 (counted by the rigs instrumented bus_space_read_1 against the guard buffer). Read bytes are only summed and compared -- no disclosure; realistic ceiling is the DF-2320-documented bridge behaviour (CardBus master abort -> panic; ISA adjacent-mapping reads / bus hang). checksum_ok proves sane checksums are unaffected by the fix. Fix validated: single-fix rig A/B (magnified bound -> too distant skip, 0 OOB) and the combined-five-fix kernel built -Werror, booted, rig re-driven from the running kernels patched source: 0 OOB, checksum_ok still accepted.",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "exploit_chain": "evil card -> pccard_attach_card -> pccard_read_cis -> pccard_scan_cis -> CISTPL_CHECKSUM with offset/length chosen to pass the unmagnified :247-249 check -> 2045 bus_space_read_1 calls at byte offsets 4096..8184 on a 4096-byte mapping -> bridge-dependent master-abort panic / adjacent-mapping reads / bus hang (DoS)",
  "evidence": "run.log (checksum: OOB: 2045 ... first=4096 max=8184; checksum_ok 110 in-window reads, 0 OOB); fixed_run.log (f5363: 0 OOB, checksum_ok still accepted); matrix.log (only f5363 flips); postboot_run.log (checksum 10 reads 0 OOB on the booted fixed kernel)",
  "kernel_refs": [
    "sys/bus/pccard/pccard_cis.c:62",
    "sys/bus/pccard/pccard_cis.c:130",
    "sys/bus/pccard/pccard_cis.c:131",
    "sys/bus/pccard/pccard_cis.c:145",
    "sys/bus/pccard/pccard_cis.c:221",
    "sys/bus/pccard/pccard_cis.c:237",
    "sys/bus/pccard/pccard_cis.c:247",
    "sys/bus/pccard/pccard_cis.c:248",
    "sys/bus/pccard/pccard_cis.c:255",
    "sys/bus/pccard/pccard_cis.c:259"
  ],
  "poc_changes": "Upgraded the seeded model to the verbatim rig; reproduces the seeded claimed numbers exactly (2045 OOB reads, max 8184) on the production code; added checksum_ok negative control for the fix A/B.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1000,
  "guest_dirty": 0,
  "build_cmd": "sh extract.sh . && cc -O2 -Wall -o rig rig_main.c",
  "run_cmd": "./rig checksum && ./rig checksum_ok   (A/B: sh run_matrix.sh)",
  "code_hash": "908c166959ac485b7dadf00c66e9ec963ba421de027b157ddc056f2ed3837319",
  "notes": "Verbatim-rig standard (orchestrator-approved method for this hardware-gated parser; DF-1040/1041 precedent): the compiled parser text is the guests own /usr/src production code, sha256-gated at extraction (extract_manifest.txt). Kernel entry unreachable on this guest: no PCMCIA bridge, no /dev/pccard*, no pccardc (env.txt) -- impact statements are the in-kernel consequences of the demonstrated production-code behavior. Deterministic across two independent boots (identical matrix). Guest left up and clean on the with-src snapshot; pristine pccard_cis.c sha256 acdd2484... re-verified after reset. Incidental: poweroff of the freshly-installed test kernel #1 required a QEMU kill on both takes (no panic trace in the serial console; stock kernel shuts down cleanly) -- VM artifact, not a parser finding.",
  "recommended_fix": "Magnify the length term in the too-distant check: addr + tuple.mult * length >= PCCARD_CIS_SIZE instead of addr + length >= PCCARD_CIS_SIZE.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "VALIDATED. (1) Single-fix rig A/B: magnified bound (addr + mult*length >= 4096) -> crafted checksum rejected as too distant (0 OOB), checksum_ok (0+2*100=200 < 4096) still accepted; only this findings scenarios change. (2) Combined five-fix kernel build+boot+running-source re-run: 0 OOB, negative control intact.",
  "fix_evidence": "fix.diff; fixed_run.log; matrix.log (single-fix A/B); kernel_apply.log + kernel_build.tail.log + env.txt + postboot_extract_manifest.txt + postboot_run.log (combined-fix kernel build/boot/running-source rerun)"
}