⬢ DragonFlyBSD Kernel Audit
DF-5588 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
{
  "finding_id": "DF-5588",
  "title": "sdt_probe() accepts hint.acpi.0.rsdp with zero validation - total-acceptance injection vector for the crafted-ACPI family and one-line boot brick",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "cd findings/poc/DF-5588 && ./build.sh",
    "run": "vm.sh reset with-src; vm.sh run_root 'printf \"hint.acpi.0.rsdp=0x40000000\\nboot_verbose=YES\\n\" >> /boot/loader.conf; sync'; vm.sh down; QEMU_EXTRA=\"-device loader,file=$PWD/nosig_bsp_omit.bin,addr=0x40000000,force-raw=on\" vm.sh up 150; vm.sh log",
    "expected": "R2: 'ACPI SDT: RSDP in kenv hint' + madt_lapic_probe lapic_count=3 with RSDP signature de ad be ef de ad be ef (acceptance proof); R3: panic: assertion \"arg.bsp_found\" in madt_lapic_pass2 through the INVALID-signature RSDP; R4 (hint=0x800000000000, no blob): panic: vm_fault: fault on nofault entry right after 'ACPI SDT: RSDP in kenv hint'"
  },
  "kernel_refs": [
    "sys/platform/pc64/acpica/acpi_sdt.c:71",
    "sys/platform/pc64/acpica/acpi_sdt.c:109",
    "sys/platform/pc64/acpica/acpi_sdt.c:120",
    "sys/platform/pc64/x86_64/pmap.c:6192",
    "sys/platform/pc64/x86_64/pmap.c:6201",
    "sys/platform/pc64/acpica/OsdEnvironment.c:72",
    "sys/platform/pc64/acpica/acpi_madt.c:375"
  ],
  "fix_validated": true,
  "artifacts": [
    "gen_rsdp_inject.py",
    "valid_control.bin",
    "nosig_control.bin",
    "nosig_bsp_omit.bin",
    "build.sh",
    "run.sh",
    "run.nosig_control.boot.log",
    "run.nosig_bsp_omit.boot.log",
    "run.bogus_addr.panic.log",
    "panic.txt",
    "fix_run.log",
    "fix_build.log",
    "fix.diff",
    "VERDICT.md",
    "env.txt",
    "manifest.json",
    "verdict.json"
  ]
}