⬢ DragonFlyBSD Kernel Audit
DF-5499 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-5499",
  "title": "passioctl() takes no periph reference across blocking CAMIOCOMMAND paths (hold/release-balance class; hardening)",
  "verdict": "not_reproduced",
  "impact": "none",
  "confidence": "speculative",
  "reproduce": {
    "build": "sh build.sh",
    "run": "sh run.sh",
    "expected": "Negative proof: with a thread blocked inside CAMIOCOMMAND, umount -f of the secondary devfs prints 'vflush: Warning, cannot destroy busy device vnode' and rig stat reports pass periph refcount=1 (release never fires); no UAF, no panic."
  },
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_pass.c:451",
    "sys/bus/cam/scsi/scsi_pass.c:490",
    "sys/bus/cam/scsi/scsi_pass.c:577",
    "sys/bus/cam/cam_periph.c:846",
    "sys/bus/cam/cam_periph.c:863",
    "sys/bus/cam/cam_periph.c:573",
    "sys/vfs/devfs/devfs_vnops.c:1146"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "passsim.c", "poc5499.c", "sset.c", "Makefile",
    "build.sh", "run.sh", "build.log", "run_full.log", "run.log",
    "console.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}