⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0060

DT_HASH d_ptr dereferenced without bounds validation - wild kernel read in parse_dynamic

Summary

parse_dynamic (link_elf.c:240-248): DT_HASH case computes hashtab=ef->address+dp->d_un.d_ptr (d_ptr is Elf64_Xword uint64) with no d_ptr<lf->size check; immediate hashtab[0]/hashtab[1] deref -> wild read from ef->address+arbitrary; nbuckets/nchains attacker-influenced control ef->chains wild pointer. Same gap in DT_STRTAB/DT_SYMTAB/DT_REL/DT_RELA/DT_JMPREL/DT_PLTGOT. Root-only defense-in-depth.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0060 · 5 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff 2.1 KB view raw
VERDICT.md verdict source-trace and fix validation 1.3 KB ↓ raw
README.md readme reproduce instructions 808 B ↓ raw
build.sh build-log build script 329 B view raw
run.sh run-log run script 392 B view raw
README.md readme reproduce instructions
↓ download raw

DF-0060 — REPRODUCED (source-only, root-only kldload)

Build

sh build.sh

(source-only confirmation; no userspace build required for the trigger itself)

Run

sh run.sh

Expected

none (root-only) on the unfixed kernel; after applying fix.diff the cited defect is closed. This finding was verified by source-tracing sys/kern/link_elf.c against the master DEV tree and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).

Mechanism

parse_dynamic DT_HASH case: hashtab=ef->address+dp->d_un.d_ptr with no d_ptrsize check; immediate hashtab[0]/hashtab[1] deref → wild read from ef->address+arbitrary; nbuckets/nchains are attacker-controlled. Same gap in DT_STRTAB/DT_SYMTAB/DT_REL/DT_RELA/DT_JMPREL/DT_PLTGOT.

VERDICT.md verdict source-trace and fix validation
↓ download raw

DF-0060 — REPRODUCED (source-only, root-only kldload)

Verdict

REPRODUCED (source-only, root-only kldload)

Mechanism

parse_dynamic DT_HASH case: hashtab=ef->address+dp->d_un.d_ptr with no d_ptrsize check; immediate hashtab[0]/hashtab[1] deref → wild read from ef->address+arbitrary; nbuckets/nchains are attacker-controlled. Same gap in DT_STRTAB/DT_SYMTAB/DT_REL/DT_RELA/DT_JMPREL/DT_PLTGOT.

Source trace

PoC changes

Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.

Fix validation

  • fix.diff applies cleanly with git apply --check -p1 and patch -p1 --forward.
  • Combined kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously.
  • Build log: ../../combined_40_low_severity_kernel_build.log (NK_DONE rc=0).

Bounds-check d_ptr against lf->size in each case; for DT_HASH also bounds-check the 2*sizeof(Elf_Hashelt) read. Matches finding proposal.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED via combined kernel build rc=0.

baseline: no d_ptr bounds check / patched: < lf->size guards in 7 DT cases, build rc=0.
↓ fix.diffDragonFly 6.5-DEVELOPMENT combined-build rc=0

Confirmed kernel references

Detail

Exploit chain

none (root-only kldload)

Evidence (decisive lines)

link_elf.c:244 no d_ptr<lf->size check before hashtab deref.

PoC changes

Authored fix.diff: bounds-check d_ptr against lf->size in DT_HASH/STRTAB/SYMTAB/PLTGOT/REL/JMPREL/RELA cases.

Verified recommended fix

Bounds-check dp->d_un.d_ptr < lf->size in each DT_* case that derefs ef->address + d_ptr. Matches finding proposal.

Verdict

REPRODUCED (source-only, root-only). link_elf.c:240-248 DT_HASH computes hashtab=ef->address+dp->d_un.d_ptr (uint64) with no d_ptrsize check; immediate hashtab[0]/[1] deref → wild read. Same gap in DT_STRTAB/DT_SYMTAB/DT_REL/DT_RELA/DT_JMPREL/DT_PLTGOT.