⬢ DragonFlyBSD Kernel Audit
DF-5668 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5668",
  "title": "AcpiOsGetRootPointer() accepts hint.acpi.0.rsdp with zero validation: second kenv RSDP consumer feeding ACPICA; FADT-less crafted chain panics boot at AcpiTbLoadNamespace+0x36",
  "file": "sys/platform/pc64/acpica/OsdEnvironment.c",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh (blobs); guest: cd /usr/src && git apply -p0 fix.diff && make -j8 nativekernel KERNCONF=X86_64_GENERIC && make installkernel",
    "run": "loader.conf hint.acpi.0.rsdp=0x40000000 + QEMU -device loader,file=nosig_fadtless.bin,addr=0x40000000,force-raw=on; boot",
    "expected": "stock: lapic_count=3, acpi0: <DFBSD >, Fatal trap 12, Stopped at AcpiTbLoadNamespace+0x36 (cmpl $0x54445344); patched: 'AcpiOsGetRootPointer: kenv RSDP failed validation, falling back to firmware scan', acpi0 <BOCHS BXPC> attached, clean boot"
  },
  "kernel_refs": [
    "sys/platform/pc64/acpica/OsdEnvironment.c:59",
    "sys/platform/pc64/acpica/OsdEnvironment.c:72",
    "sys/contrib/dev/acpica/source/components/tables/tbxface.c:257",
    "sys/contrib/dev/acpica/source/components/tables/tbutils.c:376",
    "sys/dev/acpica/acpi.c:462",
    "sys/dev/acpica/acpi.c:553",
    "sys/contrib/dev/acpica/source/components/tables/tbxfload.c:275",
    "sys/contrib/dev/acpica/source/components/tables/tbxfroot.c:211",
    "sys/contrib/dev/acpica/source/include/acglobal.h:171",
    "sys/contrib/dev/acpica/source/components/tables/tbfadt.c:490",
    "sys/dev/acpica/Osd/OsdMemory.c:85",
    "sys/platform/pc64/acpica/acpi_sdt.c:71"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "gen_chain.py", "nosig_fadtless.bin",
    "valid_fadtless.bin", "build.sh", "run.sh", "build.log",
    "run.S1_nosig.boot.log", "panic.txt", "run.S2_validfadtless.boot.log",
    "run.S3_zeroed_wedge.boot.log", "fixrun.F1_nosig.boot.log",
    "fixrun.F2_validfadtless.boot.log", "fixrun.F3_zeroedhint.boot.log",
    "fix.diff", "fix_build.log", "env.txt", "manifest.json", "verdict.json"
  ]
}