⬢ DragonFlyBSD Kernel Audit
DF-5465 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
{
  "finding_id": "DF-5465",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "sh build.sh (guest, root; in-tree kmod recipe; builds icu_legacy_probe.ko)",
    "run": "kldload /usr/obj/usr/src/sys/modules/icu_abi_probe/icu_legacy_probe.ko (kernel without INVARIANTS)",
    "expected": "step1 (irq=1000): 'RETURNED WITHOUT ERROR' — silent OOB RMW write at icu_irqmaps[0][1000]; step2 (irq=-100000000): Fatal trap 12, 'Stopped at icu_abi_legacy_intr_config+0x25: orl $0x1,0xc(%rbx)'"
  },
  "kernel_refs": [
    "sys/platform/pc64/icu/icu_abi.c:373",
    "sys/platform/pc64/icu/icu_abi.c:379",
    "sys/platform/pc64/icu/icu_abi.c:389",
    "sys/platform/pc64/icu/icu_abi.c:396",
    "sys/platform/pc64/icu/elcr.c:78",
    "sys/sys/machintr.h:103"
  ],
  "artifacts": ["icu_legacy_probe.c", "build.sh", "run.sh", "build.log", "run.log", "run_fixed.log", "panic_wild_irq.txt", "env.txt", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"]
}