⬢ DragonFlyBSD Kernel Audit
DF-5449 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-5449",
  "title": "uvscom cfg callbacks chain sequential 1000ms-timeout EP0 vendor requests with discarded errors: evil SUNTAC-VID:PID device stretches the open+close cycle to ~6.1 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) SIGKILL-immune and stalling the USB hub event thread on unplug",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /usr/src/sys/bus/u4b/serial/hx5449 && make   (in-tree kmod, real usb_process machinery)",
    "run": "kldload ./uvscomcfgstall.ko; kldunload uvscomcfgstall; dmesg | grep HX5449",
    "expected": "HX5449[A]: closer: unblocked ELAPSED=~5930 ms (baseline open+close chain, 4+2 x 1000 ms + pause); HX5449[B]: ~1280 ms (fix mechanism: abort + 250 ms)"
  },
  "kernel_refs": [
    "sys/bus/u4b/serial/uvscom.c:634-641",
    "sys/bus/u4b/serial/uvscom.c:470-512",
    "sys/bus/u4b/serial/uvscom.c:643-651",
    "sys/bus/u4b/serial/uvscom.c:694-734",
    "sys/bus/u4b/serial/usb_serial.c:671-672",
    "sys/bus/u4b/serial/usb_serial.c:394"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "uvscom_cfgstall_harness.c", "Makefile",
    "build.sh", "run.sh", "build.log", "run.log", "run.2.log",
    "fix_compile.log", "fix_run.log", "fix.diff", "env.txt",
    "manifest.json", "verdict.json"
  ]
}