⬢ DragonFlyBSD Kernel Audit
DF-5746 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-5746",
  "file": "sys/libiconv/iconv.c",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "title": "kern.iconv.add accepts unvalidated converter table sizes: datalen=0 NULL-deref panic; short tables give attacker-directed kernel heap OOB reads disclosed through converted filenames",
  "reproduce": {
    "build": "cd /root && sh build.sh",
    "run": "kldload /boot/kernel/msdos_iconv.ko; sh prep_img.sh; vnconfig -c vn0 /root/fat.img; ./trigger_leak R1 /dev/vn0 /mnt   # leak;  ./trigger_null /dev/vn0 /mnt  # panic",
    "expected": "leak: readdir returns '???????KMKMKM...' (marker bytes from neighbouring kernel allocations) instead of ABCDEFGHIJKLMNOP.k; null: Fatal trap 12, fault VA 0x0, Stopped at iconv_xlat16_open+0x34, guest down"
  },
  "kernel_refs": [
    "sys/libiconv/iconv.c:410",
    "sys/libiconv/iconv.c:426",
    "sys/libiconv/iconv_xlat16.c:67-78",
    "sys/libiconv/iconv_xlat16.c:192",
    "sys/libiconv/iconv_xlat.c:61",
    "sys/libiconv/iconv_xlat.c:99",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:115-131",
    "sys/vfs/msdosfs/msdosfs_conv.c:946",
    "sys/kern/kern_sysctl.c:1447"
  ],
  "fix": "fix.diff (cp_datalen field + converter-side validation), validated on guest: fixed",
  "artifacts": [
    "README.md", "VERDICT.md", "common_kiconv.h", "trigger_null.c", "trigger_leak.c",
    "trigger_benign.c", "trigger_neg.c", "prep_img.sh", "build.sh", "run_leak.sh",
    "run_null.sh", "build.log", "module_build.log", "run.log", "run.1.log",
    "run.patched.log", "panic.txt", "leak_sample.txt", "env.txt", "fix.diff",
    "hashes.txt", "verdict.json", "manifest.json"
  ]
}