⬢ DragonFlyBSD Kernel Audit
DF-5739 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "verdict": "reproduced",
  "impact": "panic",
  "finding": "DF-5739: softclock hci_acl_timeout() and netisr hci_link_free()/hci_acl_recv() race on refcnt-0 links with zero locking; hci_link_free()'s callout_active() deferral is dead code on DragonFly callouts -> double hci_link_free = double kfree (demonstrated: 'memchunk already freed') and uncounted-reference UAF writes in the rx path",
  "reproduce": {
    "build": "cd /root/hcih && sh build.sh && kldload ./hci_link_harness.ko",
    "run": "sysctl hw.hlh_setup=1; (sysctl hw.hlh_race_discon=100000 &); (sysctl hw.hlh_race_frag=50000 &); sleep 1; sysctl hw.hlh_race_arm=100000",
    "expected": "within minutes: panic 'memchunk 0x... is already freed!' from kfree() <- hci_link_free+0x2c6 (probabilistic race; first hit observed on first full pass); sanity arm=5 without the flood is clean"
  },
  "kernel_refs": [
    "sys/netbt/hci_link.c:199",
    "sys/netbt/hci_link.c:213",
    "sys/netbt/hci_link.c:191",
    "sys/netbt/hci_link.c:417",
    "sys/netbt/hci_link.c:451",
    "sys/netbt/hci_link.c:483",
    "sys/netbt/hci_link.c:930",
    "sys/netbt/hci_link.c:1005",
    "sys/netbt/hci_link.c:1024",
    "sys/netbt/hci_event.c:629",
    "sys/kern/kern_timeout.c:861"
  ],
  "artifacts": [
    "harness.c", "hci_stub.c", "stub.h", "Makefile", "build.sh", "run.sh",
    "build.log", "run.log", "panic.txt", "fix_panic_patched.txt",
    "fix.diff", "fix_run.log", "env.txt", "verdict.json", "manifest.json"
  ]
}