⬢ DragonFlyBSD Kernel Audit
DF-5472 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-5472",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "The vkernel64 fork shares the pc64 DF-5470 defect and aggravates it: INKERNEL() (db_trace.c:132) is defined but never called, the only frame validation is *fp < PAGE_SIZE (db_trace.c:227), and the inherited INKERNEL definition (>= USRSTACK) is itself wrong for the vkernel (kernel KVA 512GB..1TB lies inside [0,USRSTACK~128TB); the correct bound is [KvaStart,KvaEnd)). Guest-proven on the QEMU guest with an in-vkernel rig: a walk whose chain leaves kernel KVA adopts a guest-user VA, and because vkernel copyin (copyio.c:311) never raw-derefs user VAs, the walks db_read_bytes deref is a guaranteed fault (Fatal trap 12, VA=0x100000008, the f_retaddr read at db_trace.c:231, faulting insn movzbl (%rdi),%ecx at 0x71ca40) which then detonates the broken no-fault recovery (DF-5473) and kills the vkernel process. Kernel-KVA values in the chain are steerable: the clean run printed the rig-chosen symbol kprintf() at 0x50d850.",
  "exploit_chain": "guest process / stack corruption steers frame pointers -> walk escapes kernel KVA -> guaranteed SIGSEGV in db_read_bytes -> broken longjmp -> vkernel process killed with zero diagnostics (anti-forensics: the panic trace that trace_on_panic exists for is destroyed). No host privesc: the vkernel is an unprivileged host process.",
  "evidence": "vkrun_clean.log lines 34-44 (walk mechanics + steered symbol + survival), vkrun_bad.log lines 36-54 (escape -> Fatal trap 12 -> silence), VERDICT.md negative-results section (db_sym_numargs hardcoded FALSE at db_kld.c:107, dead trap heuristics, dladdr safe)",
  "kernel_refs": [
    "sys/platform/vkernel64/x86_64/db_trace.c:132",
    "sys/platform/vkernel64/x86_64/db_trace.c:227",
    "sys/platform/vkernel64/x86_64/db_trace.c:231",
    "sys/platform/vkernel64/x86_64/db_trace.c:244",
    "sys/platform/vkernel64/x86_64/db_trace.c:256",
    "sys/platform/vkernel64/x86_64/db_trace.c:268",
    "sys/platform/vkernel64/x86_64/db_trace.c:335",
    "sys/platform/vkernel64/include/vmparam.h:80",
    "sys/platform/vkernel64/include/vmparam.h:100",
    "sys/platform/vkernel64/platform/copyio.c:311",
    "sys/vm/pmap.h:162"
  ],
  "poc_changes": "authored fresh in-vkernel rig (no seed): kernel-built harness sysctl debug.df_vk_walk driving db_stack_trace_cmd from live syscall context; guest-user spray via mmap MAP_FIXED at 0x100000000; required building the VKERNEL64 kernel + a minimal UFS root image on the guest (DF-5474 build fix needed first)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (vkernel under test: DragonFly 6.5-DEVELOPMENT #1: Tue Oct 6 01:59:39 UTC 2026 VKERNEL64)",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "vm.sh run_root make nativekernel KERNCONF=VKERNEL64 on guest (after DF-5474 defsym workaround) + build_image.sh",
  "run_cmd": "vm.sh run_root sh /root/vkrig/run_vk.sh clean|bad|fixed",
  "code_hash": "b142f3328c51cdc7072bcf9bb676b6672301937517084dba3a844714f7256ed1 (vk_trace_harness.c), 065c79d15f19dbea51624f3834d50173f97ec69d1028082292773aad4cbb7020 (vktrigger.c)",
  "notes": "shared rig with DF-5473; the crash is the composition of this finding (escape) with DF-5473 (broken no-fault). guest left up; rig artifacts under guest /root/vkrig and /usr/src/sys/platform/vkernel64 (restored by vm.sh reset with-src); no guest-kernel panic.",
  "recommended_fix": "redefine INKERNEL to [KvaStart,KvaEnd) and validate every adopted frame (kernel KVA + strictly forward) in db_nextframe and the have_addr entry \u2014 see fix.diff in DF-5473 pack",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "patched vkernel with identical bad trigger: walk stops at the guest-user boundary, prints 2 frames, DFVK: walk RETURNED without crashing, clean halt, no signal death (vkrun_fixed.log); guest dmesg shows no new core dump",
  "fix_evidence": "findings/poc/DF-5472/vkrun_fixed.log lines 34-44 vs findings/poc/DF-5472/vkrun_bad.log lines 36-54; fix.diff in findings/poc/DF-5473/fix.diff (git apply --check clean against repo tree)"
}