⬢ DragonFlyBSD Kernel Audit
DF-5466 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
{
  "finding_id": "DF-5466",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "sh build.sh (guest, root; in-tree kmod recipe; builds icu_msi_start.ko)",
    "run": "echo 'hw.icu.msi_start=\"-32\"' >> /boot/loader.conf; reboot; kldload /usr/obj/usr/src/sys/modules/icu_abi_probe/icu_msi_start.ko",
    "expected": "rc=0 zone[0]=-32 zone[31]=-1 (negative vectors allocated — OOB writes into previous cpu's map row), then int3 through the smashed exception gate 3 of cpu1 -> triple fault: serial console shows the int3 line immediately followed by the bootloader menu, no trap text"
  },
  "kernel_refs": [
    "sys/platform/pc64/icu/icu_abi.c:323",
    "sys/platform/pc64/icu/icu_abi.c:473",
    "sys/platform/pc64/icu/icu_abi.c:495",
    "sys/platform/pc64/icu/icu_abi.c:499",
    "sys/platform/pc64/x86_64/machdep.c:2785",
    "sys/platform/pc64/x86_64/msi.c:433",
    "sys/kern/kern_environment.c:379"
  ],
  "artifacts": ["icu_msi_start.c", "build.sh", "run.sh", "build.log", "run.log", "run_fixed.log", "panic_triplefault.txt", "env.txt", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"]
}