⬢ DragonFlyBSD Kernel Audit
DF-5797 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
{
  "finding_id": "DF-5797",
  "verdict": "reproduced",
  "impact": "integrity-forgery (timestamp forgery by non-owner with write access; no memory corruption)",
  "reproduce": {
    "build": "cc -O -o /tmp/utimes_forge /tmp/utimes_forge.c",
    "run": "sh setup_root.sh; chown maxx /tmp/utimes_forge; su maxx -c '/tmp/utimes_forge /tmp/df5797_target'",
    "expected": "utimensat(arbitrary) -> OK and futimens(arbitrary) -> OK from uid 1001 on a root-owned mode-666 file; stat shows forged atime/mtime (0/66666, then 12345678); mode-644 control returns EACCES"
  },
  "kernel_refs": [
    "sys/kern/vfs_syscalls.c:3961",
    "sys/kern/vfs_syscalls.c:3847",
    "sys/kern/vfs_nlookup.c:1875",
    "sys/vfs/ufs/ufs_vnops.c:462"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "utimes_forge.c", "setup_root.sh",
    "build.sh", "run.sh", "build.log", "run.log", "run.2.log",
    "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}