⬢ DragonFlyBSD Kernel Audit
DF-5478 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{
  "finding_id": "DF-5478",
  "title": "efi_create_1t1_map(): md_pages*EFI_PAGE_SIZE wraparound passes the runtime-map guard — unbounded kmalloc(M_WAITOK) fill loop wedges boot",
  "verdict": "reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "ssh to guest: cc -O2 -o df5478_wrap df5478_wrap.c (userspace model of the verbatim guard arithmetic)",
    "run": "./df5478_wrap",
    "expected": "md_pages = 2^52 (and 2^52+1): product wraps to 0/4096, guard PASSES, loop iterations 4.5e15, kmalloc > 3.69e8 GiB; controls (2^40 pages) correctly REJECTed; FIXED-guard section rejects all wrap rows"
  },
  "kernel_refs": [
    "sys/platform/pc64/x86_64/efirt.c:255",
    "sys/platform/pc64/x86_64/efirt.c:256",
    "sys/platform/pc64/x86_64/efirt.c:288",
    "sys/platform/pc64/x86_64/efirt.c:290",
    "sys/platform/pc64/x86_64/efirt.c:433",
    "sys/sys/efi.h:75"
  ],
  "artifacts": [
    "df5478_wrap.c", "build.sh", "run.sh", "run.log", "fix.diff",
    "env.txt", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}