⬢ DragonFlyBSD Kernel Audit
DF-5792 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
{
  "finding_id": "DF-5792",
  "title": "closef() fdtol-chain walk vs fdfree() unlink+kfree cross-lock UAF",
  "verdict": "reproduced (exploit-development: user-steerable gated arbitrary-address 4-byte kernel zero-write machine; uid0 honestly blocked - see VERDICT.md addendum)",
  "impact": "panic (upgraded primitive: gated kernel-memory zero-write under attacker control; memcorrupt bucket)",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O2 -o exp5792 exp5792.c",
    "run": "./exp5792 120   (uid 1001, stock kernel; ~40-60% of attempts hit the original closef+0x80 fatal trap instead -- retry on a fresh boot)",
    "expected": "walker stall detected -> [verify N] victim 0x... +8..+11 = 00000000 *** KERNEL WRITE VERIFIED *** -> SUCCESS -> [sess2] second race-free verified write -> uid=1001 euid=1001; system alive"
  },
  "kernel_refs": [
    "sys/kern/kern_descrip.c:3063",
    "sys/kern/kern_descrip.c:3071",
    "sys/kern/kern_descrip.c:3074",
    "sys/kern/kern_descrip.c:3076",
    "sys/kern/kern_descrip.c:2675",
    "sys/kern/kern_descrip.c:2678",
    "sys/kern/kern_descrip.c:2686",
    "sys/kern/kern_fork.c:557",
    "sys/kern/kern_descrip.c:3346",
    "sys/sys/filedesc.h:109",
    "sys/kern/kern_descrip.c:3080",
    "sys/kern/uipc_usrreq.c:1147",
    "sys/kern/uipc_usrreq.c:1486",
    "sys/kern/kern_fork.c:570",
    "sys/kern/kern_exit.c:384"
  ],
  "artifacts": [
    "fdtol_storm.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run1.stats",
    "run2.stats",
    "fixrun1.stats",
    "fixrun2.stats",
    "serial_panic_run1.txt",
    "serial_panic_run2.txt",
    "env.txt",
    "VERDICT.md",
    "fix.diff",
    "manifest.json",
    "verdict.json",
    "exp5792.c",
    "EXPLOIT.md",
    "build_exploit.sh",
    "run_exploit.sh",
    "run_machine_success.log",
    "fix_ab/fixbuild.log",
    "fix_ab/fixrun.out"
  ]
}