⬢ DragonFlyBSD Kernel Audit
DF-5365 / run.log
← back to finding ↓ download raw
DF5365: A: mapped attacker PA 0xcb3e000 (kva 0xfffff801170ee000)
DF5365: A: LAPIC_MEM_READ(version)=aaaaaaaa (attacker fill 0xaaaaaaaa) READ-PRIMITIVE CONFIRMED
DF5365: A: eoi(+0xb0) == 0x00000000 (lapic.c:406) WRITE-CONFIRMED
DF5365: A: icr_timer(+0x380) == 0xffffffff (lapic.c:451) WRITE-CONFIRMED
DF5365: A: dcr_timer(+0x3e0) == 0x00 (lapic.c:440) WRITE-CONFIRMED
DF5365: A: svr=0xaaaaa9ff lint0=0xaaab0faa lint1=0xaaab0caa tmr=0xaaabaae4 (fill was 0xaaaaaaaa)
DF5365: A: 7/7 register cells of the attacker page were written by the production store set -> ARBITRARY-PA WRITE CONFIRMED
DF5365: B: mapped kernel BSS PA 0x18d9dac so that 'icr_timer' aliases cpu_id_to_apic_id[3]
DF5365: B: cpu_id_to_apic_id[3] before=0x00000003
DF5365: B: cpu_id_to_apic_id[3] after =0xffffffff -> KERNEL-BSS CORRUPTION CONFIRMED
DF5365: state restored (cpu_id_to_apic_id[3]=0x00000003 lapic_mem=0)
DF5365: done