⬢ DragonFlyBSD Kernel Audit
DF-5475 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-5475",
  "manifest_version": 1,
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "file": "sys/cpu/x86_64/misc/x86_64-gdbstub.c",
  "title": "gdb_handle_exception entered with gdb_tab == NULL: putpacket()/getpacket() treat getDebugChar()==-1 as data (and the shipped gcc8 constprop clone drops the NULL guards) -> NULL-deref fault storm / permanent all-CPU hang; no ddb fallback, no dump, no reboot",
  "reproduce": {
    "build": "none needed for baseline (stock kernel); fix build: see build.sh / build.log",
    "run": "findings/poc/DF-5475/run.sh  (sysctl debug.enter_debugger=gdb over vm.sh run_root)",
    "expected": "TRIGGER_RC=124, guest stops answering ssh, QEMU alive, serial floods 'Fatal trap 12' at putpacket+0x2c reading 0x68 forever (serial.baseline.txt)"
  },
  "kernel_refs": [
    "sys/cpu/x86_64/misc/x86_64-gdbstub.c:147",
    "sys/cpu/x86_64/misc/x86_64-gdbstub.c:156",
    "sys/cpu/x86_64/misc/x86_64-gdbstub.c:189",
    "sys/cpu/x86_64/misc/x86_64-gdbstub.c:277",
    "sys/cpu/x86_64/misc/x86_64-gdbstub.c:448",
    "sys/cpu/x86_64/misc/x86_64-gdbstub.c:531",
    "sys/platform/pc64/x86_64/db_interface.c:105",
    "sys/platform/pc64/x86_64/db_interface.c:179",
    "sys/ddb/db_sysctl.c:57",
    "sys/dev/serial/sio/sio.c:3131",
    "sys/platform/pc64/x86_64/trap.c:1096",
    "sys/sys/cons.h:72"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "run.sh", "run_control.sh", "run_patched.sh",
    "build.sh", "run.log", "run.control.log", "run.patched.log",
    "serial.baseline.txt", "serial.control.txt", "serial.patched.txt",
    "build.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}