⬢ DragonFlyBSD Kernel Audit
DF-5473 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-5473",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "The pc64 DF-5471 defect is present in the vkernel fork with worse mechanics: db_read_bytes (vkernel db_interface.c:236) arms db_nofault=&db_jmpbuf, but db_jmpbuf is only setjmpd inside an established DDB session (db_command.c:467, db_trap.c:68); every panic runs print_backtrace(6) BEFORE Debugger() (kern_shutdown.c:880-883, DDB_TRACE default) and live print_backtrace(-1) debug sites run with no debugger at all. On the vkernel the longjmp is host libcs, taken from inside the SIGSEGV handler, into a BSS-zeroed buffer: guest-proven twice \u2014 after kernel: type 12 trap, code=0 (kdb_traps own print at db_interface.c:136) the vkernel produces zero further output and the host records exited on signal 4 (core dumped); the core shows #0 0x102903f3 <longjmp+115> in /lib/libc.so.8 with rsp=0x0 rbp=0x0. The state equality with the panic path was logged by the harness right before the walk: db_active=0 db_jmpbuf[0]=0000000000000000 db_jmpbuf[3]=0000000000000000.",
  "exploit_chain": "any vkernel panic with a corrupted frame chain (or a live debug-print site hitting an unmapped frame) -> SIGSEGV in db_read_bytes -> exc_segfault -> kern_trap -> trap_pfault -> trap_fatal -> kdb_trap -> longjmp(never-initialized db_jmpbuf) -> libc longjmp restores rsp=0/rbp=0 -> SIGILL at longjmp+115 -> vkernel process dies, core dumped, panic backtrace and DDB both lost. No host privesc (vkernel is an unprivileged host process).",
  "evidence": "vkrun_bad.log (54 lines, ends at kernel: type 12 trap, code=0); core_gdb.txt (rip=0x102903f3, rsp=0x0, rbp=0x0, signal 4) plus matching-build first-session symbolization longjmp+115 in /lib/libc.so.8 recorded in VERDICT.md; guest dmesg pid (kernel.stripped), uid 0: exited on signal 4 (core dumped); vkrun_clean.log (control survives \u2014 crash is the recovery path, not the harness)",
  "kernel_refs": [
    "sys/platform/vkernel64/x86_64/db_trace.c:231",
    "sys/platform/vkernel64/x86_64/db_trace.c:443",
    "sys/platform/vkernel64/x86_64/db_interface.c:136",
    "sys/platform/vkernel64/x86_64/db_interface.c:138",
    "sys/platform/vkernel64/x86_64/db_interface.c:236",
    "sys/ddb/db_command.c:62",
    "sys/ddb/db_command.c:467",
    "sys/ddb/db_trap.c:68",
    "sys/kern/kern_shutdown.c:881",
    "sys/platform/vkernel64/x86_64/trap.c:583",
    "sys/platform/vkernel64/x86_64/trap.c:959",
    "sys/platform/vkernel64/x86_64/exception.c:263"
  ],
  "poc_changes": "authored fresh in-vkernel rig (no seed): sysctl-driven db_stack_trace_cmd call from live syscall context reproducing the exact panic-path state; VKERNEL64 kernel built on the guest (required DF-5474 defsym workaround to link) + minimal UFS root image",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (vkernel under test: DragonFly 6.5-DEVELOPMENT #1: Tue Oct 6 01:59:39 UTC 2026 VKERNEL64)",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "vm.sh run_root make nativekernel KERNCONF=VKERNEL64 on guest + sh /root/vkrig/build_image.sh",
  "run_cmd": "vm.sh run_root sh /root/vkrig/run_vk.sh clean|bad|fixed",
  "code_hash": "b142f3328c51cdc7072bcf9bb676b6672301937517084dba3a844714f7256ed1 (vk_trace_harness.c), 065c79d15f19dbea51624f3834d50173f97ec69d1028082292773aad4cbb7020 (vktrigger.c)",
  "notes": "reproduced twice deliberately + once accidentally; isolated longjmp-on-zeroed-jmp_buf test on guest exits 139 (SIGSEGV) \u2014 inside the vkernel signal context it manifests as SIGILL in libc longjmp. Rig artifacts on guest under /root/vkrig; guest kernel untouched and up.",
  "recommended_fix": "walk-side: validate frames (fix.diff, shared with DF-5472). complete fix: db_interface.c must arm a jmp_buf that is valid whenever db_nofault can fire (setjmp a local in print_backtrace()/db_stack_trace_cmd() entry, or fall back to db_global_jmpbuf when no DDB loop ever ran)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "patched db_trace.c (KvaStart/KvaEnd walk validation) removes the demonstrated trigger: identical bad run prints 2 frames, DFVK: walk RETURNED without crashing, sysctl returns, clean halt, no signal-4 death (vkrun_fixed.log). db_interface.c-level hardening noted as the complete remediation.",
  "fix_evidence": "findings/poc/DF-5473/vkrun_fixed.log lines 34-46 vs findings/poc/DF-5473/vkrun_bad.log; fix.diff applies clean to repo tree (git apply --check)"
}