⬢ DragonFlyBSD Kernel Audit
DF-5779 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-5779",
  "title": "seq_puts() shim passes its data string as the ksnprintf format (kernel format-string trap; %n write conv live)",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "in-guest: cd /tmp/rig && make SYSDIR=/usr/src/sys WERROR=\"\" (bsd.kmod.mk); host wrapper ./build.sh",
    "run": "kldload /tmp/rig/seqputs_rig.ko (A+B, dmesg); kldload /tmp/rig/seqputs_rigc.ko (panic); fix: kldload seqputs_rigfix.ko",
    "expected": "A: '%n wrote 2'; B: 'link=0' (interpreted vararg slot); C: Fatal trap 12 at strlen, guest down; fixed: all inputs verbatim, guest alive"
  },
  "kernel_refs": [
    "sys/dev/drm/include/linux/seq_file.h:44",
    "sys/dev/drm/linux_printf.c:32",
    "sys/dev/drm/drm_print.c:128",
    "sys/dev/drm/drm_print.c:163",
    "sys/dev/drm/include/drm/drm_print.h:184",
    "sys/kern/subr_prf.c:688",
    "sys/kern/subr_prf.c:750",
    "sys/dev/drm/drm_internal.h:139"
  ],
  "artifacts": [
    "seqputs_rig.c", "seqputs_rigc.c", "seqputs_rigfix.c",
    "build.sh", "run.sh", "build.log", "run.log", "run_c.log", "fix_run.log",
    "panic.txt", "disasm.txt", "env.txt", "fix.diff",
    "VERDICT.md", "README.md", "manifest.json", "verdict.json"
  ]
}