DF-5746 / run.patched.log
4 1 0xffffffff82600000 f000 msdos_iconv.ko 5 1 0xffffffff8260f000 4000 libiconv.ko newfs_msdos: warning, /root/fat.img is not a character device === PATCHED: trigger_null (expect EINVAL, no panic) === [+] registered pair to=PWNX2 from=UTF-16BE datalen= 0 csid=3 [*] mounting with KICONV cs_local=PWNX2 -> iconv_xlat16_open() on cp_data==NULL ... trigger_null: mount msdos /dev/vn0: Invalid argument trigger_null: mount returned (no panic?) NULL_RC=1 === PATCHED: trigger_leak (expect EINVAL, no leak) === trigger_leak: mount msdos /dev/vn0: [+] registered pair to=PWNLP1 from=UTF-16BE datalen= 4096 csid=4 [*] victim 'PWNLP1:UTF-16BE' allocates 4096 bytes (index only) but its index references 18 data blocks => every converted char reads 4096..12800 bytes PAST the allocation [+] registered pair to=MKP1_00 from=MRKP100 datalen= 4096 csid=5 [+] registered pair to=MKP1_01 from=MRKP101 datalen= 4096 csid=6 [+] registered pair to=MKP1_02 from=MRKP102 datalen= 4096 csid=7 [+] registered pair to=MKP1_03 from=MRKP103 datalen= 4096 csid=8 [+] registered pair to=MKP1_04 from=MRKP104 datalen= 4096 csid=9 [+] registered pair to=MKP1_05 from=MRKP105 datalen= 4096 csid=10 [+] registered pair to=MKP1_06 from=MRKP106 datalen= 4096 csid=11 [+] registered pair to=MKP1_07 from=MRKP107 datalen= 4096 csid=12 [+] registered pair to=MKP1_08 from=MRKP108 datalen= 4096 csid=13 [+] registered pair to=MKP1_09 from=MRKP109 datalen= 4096 csid=14 [+] registered pair to=MKP1_10 from=MRKP110 datalen= 4096 csid=15 [+] registered pair to=MKP1_11 from=MRKP111 datalen= 4096 csid=16 [+] registered pair to=MKP1_12 from=MRKP112 datalen= 4096 csid=17 [+] registered pair to=MKP1_13 from=MRKP113 datalen= 4096 csid=18 [+] registered pair to=MKP1_14 from=MRKP114 datalen= 4096 csid=19 [+] registered pair to=MKP1_15 from=MRKP115 datalen= 4096 csid=20 [+] registered pair to=UTF-16BE from=PWNLP1 datalen= 4608 csid=21 [+] registered pair to=PWNDP1 from=PWNLP1 datalen= 4608 csid=22 [+] registered pair to=PWNLP1 from=PWNDP1 datalen= 4608 csid=23 Invalid argument trigger_leak: mount failed LEAK_RC=1 === PATCHED: trigger_benign (expect success, deterministic names) === [+] registered pair to=BENG1 from=UTF-16BE datalen=13312 csid=24 [+] registered pair to=UTF-16BE from=BENG1 datalen=13312 csid=25 [+] registered pair to=BNDG1 from=BENG1 datalen=13312 csid=26 [+] registered pair to=BENG1 from=BNDG1 datalen=13312 csid=27 [+] mounted /dev/vn0 at /mnt (cs_local=BENG1 cs_dos=BNDG1) --- dirent namlen=1: . --- dirent namlen=2: .. --- dirent namlen=33: B\x01B\x02B\x03B\x04B\x05B\x06B\x07B\x08B\x09B\x0aB\x0bB\x0cB\x0dB\x0eB\x0fB\x10B [+] benign control done BENIGN_RC=0 === GUEST STILL UP === 3:13AM up 52 secs, 0 users, load averages: 0.11, 0.04, 0.01