⬢ DragonFlyBSD Kernel Audit
DF-5657 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-5657",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "scp -F dfbsd-qemu/config poc.c dfbsd-maxx:/tmp/poc.c && dfbsd-qemu/vm.sh run_user 'cc -O -o /tmp/poc /tmp/poc.c'",
    "run": "dfbsd-qemu/vm.sh run_user '/tmp/poc 1 0'   # baseline, no crash; then dfbsd-qemu/vm.sh run_user '/tmp/poc 2'   # attack -> fatal trap 9 at cpu_heavy_restore+0x1ab movl %eax,%dr7",
    "expected": "baseline: PT_SETDBREGS(dr7=0) accepted, guest stays up. attack: PT_SETDBREGS(dr7=0xdeadbeef00000000) accepted by set_dbregs, then on PT_CONTINUE the kernel takes a ring-0 #GP at the cpu_heavy_restore DR7 load -> 'Fatal trap 9: general protection fault while in kernel mode ... Stopped at cpu_heavy_restore+0x1ab: movl %eax,%dr7', current process = the uid-1001 tracee; ssh dies, vm.sh status -> down."
  },
  "kernel_refs": [
    "sys/platform/pc64/x86_64/procfs_machdep.c:97",
    "sys/platform/pc64/x86_64/machdep.c:3133",
    "sys/platform/pc64/x86_64/machdep.c:3166",
    "sys/platform/pc64/x86_64/machdep.c:3220",
    "sys/platform/pc64/x86_64/machdep.c:3222",
    "sys/platform/pc64/x86_64/swtch.s:597",
    "sys/platform/pc64/x86_64/swtch.s:612",
    "sys/platform/pc64/x86_64/swtch.s:617",
    "sys/platform/pc64/x86_64/trap.c:675",
    "sys/platform/pc64/x86_64/trap.c:770",
    "sys/kern/sys_process.c:531",
    "sys/vfs/procfs/procfs_dbregs.c:66"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "poc.c", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "panic.txt", "env.txt",
    "fix.diff", "fix_build.log", "fix_run.log", "manifest.json", "verdict.json"
  ]
}