โฌข DragonFlyBSD Kernel Audit
DF-5630 / run.log
โ† back to finding โ†“ download raw
== DF-5630 baseline (vulnerable kernel #0) โ€” decisive run ==
guest# sh /tmp/df5630/run_guest.sh
== case 1: nonote (EI_OSABI=255, no PT_NOTE) โ€” expect ENOEXEC ==
/tmp/df5630/note_none.bin: Exec format error. Binary file not executable.
-> exec failed as expected (ENOEXEC)
== case 2: control note (descriptor present) โ€” expect p_osrel=0x44332211 ==
ctl pid=5702 (spinning)
debug.df_osrel_pid: 0 -> 5702
ctl p_osrel=1144201745 (expect 1144201745 = 0x44332211)
== case 3: BUG note (descriptor read fully past page end) ==
run 1: bug pid=5712 (spinning)
  bug p_osrel=537537071 (0x200a2a2f)
run 2: bug pid=5723 (spinning)
  bug p_osrel=537537071 (0x200a2a2f)
run 3: bug pid=5734 (spinning)
  bug p_osrel=537537071 (0x200a2a2f)

0x200a2a2f = bytes 2f 2a 0a 20 = "/*\n " โ€” present nowhere in the crafted
file (4095 bytes); it is the content of the physical page following the
executable's first page, read through the DMAP.

== DF-5630 fix validation (patched kernel #1, fix.diff applied) ==
== case 1: nonote ==
/tmp/df5630/note_none.bin: Exec format error. Binary file not executable.
-> exec failed as expected (ENOEXEC)
== case 2: control note ==
ctl pid=1188 (spinning)
ctl p_osrel=1144201745 (expect 1144201745 = 0x44332211)   # NO REGRESSION
== case 3: BUG note ==
/tmp/df5630/note_bug.bin: Exec format error. Binary file not executable.
run 1..3: bug p_osrel=-1 (harness sentinel โ€” process rejected at exec)  # FIXED