⬢ DragonFlyBSD Kernel Audit
DF-5376 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-5376",
  "verdict": "reproduced",
  "impact": "memcorrupt (arbitrary-address kernel write; cam_simq corruption -> RIP-control chain)",
  "confidence": "certain",
  "reproduce": {
    "build": "guest root, /root/targpwn: make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC (targsim.ko) && cc -O0 -g -o poc5376 poc5376.c",
    "run": "kldload ./targsim.ko; sleep 2; ./poc5376 a   (clean write demo, guest lives); then (after reset+rig) ./poc5376 b  (RIP-control chain, guest dies)",
    "expected": "mode a: fake ccb_h.status 0 -> 0x42 and fake dev->qfrozen_cnt 0x11110000 -> 0x11110001 printed by the PoC, write() returns 8. mode b: Fatal trap 12 supervisor WRITE at fake_sim+0x48, Stopped at swi_cambio+0x59 (current process Idle)."
  },
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_target.c:626",
    "sys/bus/cam/scsi/scsi_target.c:741",
    "sys/bus/cam/cam_xpt.c:3075",
    "sys/bus/cam/cam_xpt.c:3094",
    "sys/bus/cam/cam_xpt.c:4891",
    "sys/bus/cam/cam_xpt.c:7432"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "targsim.c", "Makefile", "poc5376.c",
    "build.sh", "run.sh", "build.log", "run.log", "run.b.log",
    "run.patched.log", "panic.b.txt", "fix.diff", "fix_build.log",
    "manifest.json", "verdict.json"
  ]
}