⬢ DragonFlyBSD Kernel Audit
DF-5713 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5713",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Every claim reproduced live on the 6.5-DEVELOPMENT X86_64_GENERIC guest: the kernels only canary symbol __guard is the compile-time constant 0x00000aff (sys/libkern/stack_protector.c:36) \u2014 /dev/kmem reads ff 0a 00 00 on two independent fresh boots and the ELF .data cell matches, so no seeding exists anywhere in boot (karc4random is never involved); the modern __stack_chk_guard/__stack_chk_fail ABI is absent from the kernel (a -fstack-protector-all KLD fails kldload with link_elf_obj_obj: symbol __stack_chk_guard undefined); sys/platform/pc64/conf/kern.mk:7 force-disables -fstack-protector for all kernel/KLD code, so a default-built modules 48->16 kernel-stack strcpy smashes the saved frame pointer to 0x4242424242424242 and kills the kernel at boom+0x2c ret with no canary in the frame; the legacy __stack_smash_handler panic path itself works (panic: stack overflow in function guard_panic_smash_test). The mitigation layer protects exactly nothing; it is dead code force-linked via sys/platform/pc64/conf/files:119 with a publicly-known canary value. Hardening failure (CWE-693/CWE-330): no unprivileged attack path through the file itself, hence impact none \u2014 but every kernel stack-overflow bug elsewhere in sys/ lands on unprotected frames, and any future SSP enablement would inherit the known-constant canary unless the file is fixed.",
  "exploit_chain": "",
  "evidence": "run.2.log (live /dev/kmem read ff 0a 00 00, guard_probe KLD __guard=0xaff, objdump ELF cell ff0a0000); run.4.log (fresh boot #2 identical bytes \u2014 no per-boot seeding); panic.txt (link_elf_obj_obj: symbol __stack_chk_guard undefined + Fatal trap 9 with frame pointer 0x4242424242424242, Stopped at boom+0x2c: ret); panic2.txt (panic: stack overflow in function guard_panic_smash_test with backtrace); build.log (kmod CFLAGS show -fno-stack-protector from kern.mk; manual -fstack-protector-all build shows U __stack_chk_guard/__stack_chk_fail); console_full.log (full serial); guest/ (all sources); fix.diff (git apply --check clean)",
  "kernel_refs": [
    "sys/libkern/stack_protector.c:36",
    "sys/libkern/stack_protector.c:38",
    "sys/libkern/stack_protector.c:49",
    "sys/platform/pc64/conf/files:119",
    "sys/platform/pc64/conf/kern.mk:7",
    "sys/conf/files:2219",
    "stand/boot/dloader/Makefile:36",
    "sys/libkern/arc4random.c:168"
  ],
  "poc_changes": "Rewrote from scratch: original task sketch assumed karc4random-seeded __stack_chk_guard; the file actually implements the 2002 propolice ABI (constant int __guard + __stack_smash_handler). Built 4 artifacts: guard_read.c (/dev/kmem reader; fixed lseek error check for sign-extended kernel addresses), ssp_smash KLD (smash probe, two variants), guard_probe KLD (live symbol read), guard_panic KLD (fail-path trigger). bsd.kmod.mk (not kmod.mk) is the include name on DF; -fstack-protector-all must be compiled by hand because kern.mk strips it.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 960,
  "guest_dirty": 0,
  "build_cmd": "tar czf - -C findings/poc/DF-5713 guest | base64 | vm.sh run_root openssl base64 -d | tar xzf - -C /tmp; cc -O2 -o guard_read guard_read.c; make -m /usr/share/mk (each KLD dir); manual SSP build per build.log",
  "run_cmd": "vm.sh run_root /tmp/guest/guard_read 0xffffffff8113bae0 /dev/kmem; kldload .../ssp_smash_ssp.ko; kldload .../guard_probe.ko; kldload .../ssp_smash.ko (panics); kldload .../guard_panic.ko (panics)",
  "code_hash": "a5f48cb43b2660195fc779e5fdf9943958dad876704fe9a7e3f5cb554f059842",
  "notes": "Cross-boot constancy proven across two vm.sh reset with-src boots. The i386-only caller-PC read (stack_protector.c:46) and the %s panic format are benign. dloader (stand/boot/dloader/Makefile:36) compiles the same file for the boot loader \u2014 no SSP flag there either. Reserved IDs DF-5714..5725 unused (single finding).",
  "recommended_fix": "Provide the modern ABI in this file (unsigned long __stack_chk_guard seeded once from karc4random_buf at SI_SUB_DRIVERS + __stack_chk_fail panic; also reseed legacy __guard) and flip kern.mk from -fno-stack-protector to -fstack-protector-strong; see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Fix not build-validated: this is a hardening finding (no memory-corruption reproduction to A/B), and the kern.mk hunk requires a full kernel rebuild+boot validation that belongs upstream. fix.diff passes git apply --check against the tree; SYSINIT ordering (SI_SUB_DRIVERS=0x2400000) is provably after arc4_init_pcpu (SI_BOOT2_FINISH_SMP=0x1c80000, sys/platform/pc64/x86_64/mp_machdep.c:571) so karc4random_buf() is safe at seed time.",
  "fix_evidence": "findings/poc/DF-5713/fix.diff (git apply --check clean); ordering refs sys/platform/pc64/x86_64/mp_machdep.c:571, sys/sys/kernel.h:158,167,187"
}