⬢ DragonFlyBSD Kernel Audit
DF-5679 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
{
  "finding_id": "DF-5679",
  "file": "sys/libkern/icrc32.c",
  "pass": 2,
  "verdict": "pass-2 audit: primitives verified bit-exact (21/21 differential checks: all 9 tables element-wise vs generated references, KATs, every length 0..600 x alignment 0..3 both engines, chaining semantics, 1MiB random, guard-page OOB probe with zero faults); one real length-math defect filed as Info: iscsi_crc32/iscsi_crc32_ext take size_t but calculate_crc32c truncates to unsigned int, machine-demonstrated (0x100000009 serviced as 9) and unreachable in-tree (all callers bounded); fix.diff validated on guest",
  "impact": "none",
  "reproduce": {
    "build": "sh build.sh   (on guest: copies /usr/src/sys/libkern/{icrc32,crc32}.c, cc -O2 -Wall icrc32_diff.c; fixdemo vs fix.diff-patched copy)",
    "run": "sh run.sh",
    "expected": "RESULT: ALL-PASS (21 checks, 0 failures); T10 ... TRUNCATED (equal); baseline FIX-BAD exit 1; patched FIX-OK (sig 11 on guard page) exit 0"
  },
  "kernel_refs": [
    "sys/libkern/icrc32.c:58",
    "sys/libkern/icrc32.c:144",
    "sys/libkern/icrc32.c:250",
    "sys/libkern/icrc32.c:683",
    "sys/libkern/icrc32.c:694",
    "sys/libkern/icrc32.c:707",
    "sys/libkern/icrc32.c:740",
    "sys/libkern/icrc32.c:750",
    "sys/libkern/icrc32.c:760",
    "sys/libkern/icrc32.c:765",
    "sys/libkern/icrc32.c:776",
    "sys/libkern/icrc32.c:783",
    "sys/sys/systm.h:205",
    "sys/libkern/crc32.c:60",
    "sys/kern/kern_dmsg.c:371",
    "sys/kern/kern_dmsg.c:2009",
    "sys/vm/swap_pager.c:1876",
    "sys/vfs/hammer2/hammer2.h:1457",
    "sys/vfs/hammer2/hammer2_chain.c:5391"
  ],
  "negative_result": {
    "classes_killed": [
      "table constant corruption / wrong polynomial: all 256 entries x 9 tables verified vs bitwise-generated references incl. sliced-by-8 iterative construction (T1-T4)",
      "OOB read via init_bytes/running_length/end_bytes math: init_bytes<=4<=length guaranteed by icrc32.c:765 gate; guard-page probe 256 boundary lengths x 3 entry points, zero faults (T9)",
      "length underflow (length - init_bytes): killed, same gate",
      "unaligned 32-bit loads icrc32.c:707,723,726: post-init pointer 4-aligned by construction; benign on x86 regardless",
      "big-endian byte reconstruction icrc32.c:701-705,717-721: verified LE-word equivalent; moot on x86-only",
      "single-vs-multi engine divergence incl. length<4 boundary: every L 0..600 x align 0..3 differential PASS (T6)",
      "incremental chaining / inversion protocol (state reuse): ext(ext(0,a),b)==one-shot for iscsi_crc32_ext, crc32_ext, raw calculate_crc32c, incl. by-1/by-3 chunk churn (T7)",
      "init-once race: structurally impossible, compile-time const tables, pure stateless functions",
      "info leak: no copyout/user pointers in file",
      "consumer length overflow: all in-tree callers bounded (kern_dmsg DMSG_AUX_MAX clamp, MAXPHYS, hammer2 64KB radix, ext2fs block-sized)"
    ]
  },
  "artifacts": [
    "icrc32_diff.c", "fixdemo.c", "fix.diff", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "fix_build.log", "fix_run.log",
    "env.txt", "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ],
  "code_hashes": {
    "icrc32_diff.c": "29acbcd0a567468761346edc7a6a3ebdb0ab1b59843a3a4adec315dc6bad8386",
    "fixdemo.c": "792c776a429923c6b4d0e4d2b615fba13aa75c6b669de99c54253bdcdd859970",
    "fix.diff": "fed7a77746635dc8bf11fd3a3301d51fee995ff6db31537dd7ad68796a029027"
  },
  "code_under_test_md5": {
    "sys/libkern/icrc32.c": "29e2ead0a146caec695a6804944e3cde",
    "sys/libkern/crc32.c": "7bb201c97ceb81fec180aaf9e9a9e445"
  }
}