⬢ DragonFlyBSD Kernel Audit
DF-5793 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-5793",
  "title": "kern_dup() dup2/dup3 onto an in-flight reserved descriptor: unbounded uninterruptible retry loop + unrate-limited kprintf console/msgbuf flood",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O2 -o dup_directed dup_directed.c -lpthread",
    "run": "as unprivileged user: ./dup_directed 10; dmesg | grep -c 'target descriptor'",
    "expected": ">=1 (measured: 10 warnings + 10 full-1s uninterruptible dup2 parks in 10s; SIGKILL deferred ~1s; per-thread steady state 1 line/sec sustained)"
  },
  "kernel_refs": [
    "sys/kern/kern_descrip.c:1143",
    "sys/kern/kern_descrip.c:1146",
    "sys/kern/kern_descrip.c:1149",
    "sys/kern/sys_pipe.c:290",
    "sys/kern/kern_event.c:730",
    "sys/kern/uipc_usrreq.c:1593"
  ],
  "artifacts": [
    "dup_directed.c", "dup_reserved.c", "build.sh", "run.sh", "build.log",
    "run.log", "run.2.log", "run.3.log", "fixrun.log",
    "env.txt", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"
  ]
}