⬢ DragonFlyBSD Kernel Audit
DF-5706 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5706",
  "title": "sys/libkern/memcchr.c live longword over-read (proven page-contained and result-filtered; Info/hardening) + unreachable goto",
  "verdict": "reproduced",
  "impact": "none",
  "reproduce": {
    "build": "cd findings/poc/DF-5706 && (inside guest) sh ./build.sh   [KSRC=/usr/src/sys/libkern/memcchr.c]",
    "run": "cd findings/poc/DF-5706 && sh ./run.sh",
    "expected": "guard sweep 762160 calls 0 faults; differential 2608384 cases 0 failures; over-read CONFIRMED (max 7B below begin / 7B past end, 0 loads outside enclosing granules, 10948 done-filter rejections all returning NULL); fixed build: 0 out-of-range loads, differential 0 failures, guard sweep PASS"
  },
  "kernel_refs": [
    "sys/libkern/memcchr.c:83-87",
    "sys/libkern/memcchr.c:90-104",
    "sys/libkern/memcchr.c:102",
    "sys/libkern/memcchr.c:108-116",
    "sys/sys/libkern.h:142",
    "sys/conf/files:2212",
    "sys/vfs/ext2fs/ext2_alloc.c:1358",
    "sys/vfs/ext2fs/ext2_alloc.c:1362",
    "sys/vfs/ext2fs/ext2_alloc.c:1519",
    "sys/vfs/ext2fs/ext2_alloc.c:1523",
    "sys/vfs/ext2fs/ext2_vfsops.c:556-572",
    "sys/vfs/ext2fs/ext2_vfsops.c:582-587"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "extract.sh", "build.sh", "run.sh",
    "shim/prelude.h", "memcchr_kernel.c", "memcchr_body.c",
    "memcchr_instr.c", "instr_driver.c", "guard_harness.c",
    "memcchr_fixed.c", "fixed_body.c", "memcchr_fixed_instr.c",
    "fixed_driver.c", "fix.diff", "build.log", "run.log", "run.2.log",
    "journal.txt", "env.txt", "logs/guard.out", "logs/instr.out",
    "logs/fixed.out", "logs/guardfix.out", "logs/kernel_liveness.txt",
    "logs/scratch/memcchr.c.patched", "logs/scratch/memcchr.c.orig",
    "manifest.json", "verdict.json"
  ]
}