⬢ DragonFlyBSD Kernel Audit
DF-5700 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5700",
  "title": "libkern/bcmp.c compares with full longword loads reading up to 7 bytes outside [ptr,ptr+len) (by design; page-contained; file not compiled on any DFly platform)",
  "verdict": "reproduced",
  "impact": "none",
  "severity": "Low",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "guard sweep PASS (no load escapes the valid pages, 512496 cases); instrumented measurement OVERREAD-CONFIRMED (max 7 B below start / 7 B past end); fixed build: 0 out-of-region loads, 0 differential failures"
  },
  "kernel_refs": [
    "sys/libkern/bcmp.c:53-56",
    "sys/libkern/bcmp.c:58",
    "sys/libkern/bcmp.c:81-91",
    "sys/libkern/bcmp.c:100-111",
    "sys/libkern/bcmp.c:114-129",
    "sys/conf/files:2195-2237",
    "sys/platform/pc64/conf/files:131",
    "sys/platform/pc64/x86_64/bcmp.s:31",
    "sys/platform/pc64/x86_64/memcmp.s:55-65",
    "sys/cpu/x86_64/include/asm_mjgmacros.h:49-198",
    "sys/libprop/prop_object.c:739"
  ],
  "artifacts": [
    "README.md", "VERDICT.md",
    "bcmp_kernel.c", "guard_harness.c", "bcmp_instr.c", "instr_driver.c", "asan_harness.c",
    "bcmp_fixed.c", "bcmp_fixed_instr.c", "fixed_driver.c",
    "build.sh", "run.sh",
    "logs/guard.out", "logs/instr.out", "logs/fixed.out", "logs/guardfix.out",
    "logs/kernel_bcmp_disasm.txt", "logs/env.txt",
    "fix.diff", "manifest.json", "verdict.json"
  ]
}