⬢ DragonFlyBSD Kernel Audit
DF-5620 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-5620",
  "title": "Rejected _CST MWAIT descriptors still run cpu_mwait_cx_no_bmsts/bmarb (global C3 preamble corruption on the error path)",
  "verdict": "reproduced",
  "impact": "none",
  "reproduce": {
    "build": "guest: make SYSDIR=/usr/src/sys in /tmp/mwf (mwaitforce.c) -> /boot/kernel + mwaitforce_load=YES; host: python3 mkdsdt.py badhint + gen_cst.py -> /tmp/opencode/cst_badhint.bin (see build.sh)",
    "run": "QEMU_EXTRA='-machine accel=tcg -cpu SandyBridge -device loader,file=/tmp/opencode/cst_badhint.bin,addr=0x40000000,force-raw=on' vm.sh up 240; vm.sh run_root 'sysctl machdep.mwait.CX.c3_preamble' (see run.sh)",
    "expected": "control (C1-only _CST): c3_preamble 3 | attack (C1 + badhint C2): console 'C2: invalid mwait hint 0x99999971' x6 AND c3_preamble 0 | fixed kernel: same rejection lines, c3_preamble 3"
  },
  "kernel_refs": [
    "sys/platform/pc64/acpica/acpi_cstate_machdep.c:146",
    "sys/platform/pc64/acpica/acpi_cstate_machdep.c:155",
    "sys/platform/pc64/acpica/acpi_cstate_machdep.c:161",
    "sys/platform/pc64/acpica/acpi_cstate_machdep.c:165",
    "sys/platform/pc64/acpica/acpi_cstate_machdep.c:171",
    "sys/platform/pc64/acpica/acpi_cstate_machdep.c:177",
    "sys/platform/pc64/acpica/acpi_cstate_machdep.c:190",
    "sys/platform/pc64/x86_64/machdep.c:3400",
    "sys/platform/pc64/x86_64/machdep.c:3409"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "mwaitforce.c", "mkdsdt.py", "gen_cst.py",
    "dsdt_cst_badhint.dsl", "dsdt_cst_badhint.aml",
    "run.control_sysctl.txt", "run.attack_sysctl.txt",
    "run.fixedkernel_badhint.txt", "build.sh", "run.sh", "env.txt",
    "fix.diff", "manifest.json", "verdict.json"
  ]
}