db_Grp7_11 OOB read when disassembling swapgs/rdtscp (6-entry array indexed by f_reg returning 7)
Summary
db_Grp7_11 at db_disasm.c:204-211 has 6 slots (0..5); db_Grp7_11_111 misplaced at slot 5 instead of 7. :1275 indexes db_Grp7_11[f_reg(rex,regmodrm)] where f_reg returns 7 for modrm 0xF8..0xFF (swapgs 0F 01 F8, rdtscp 0F 01 F9). Index 7 reads 16 bytes past array end into db_Grp8 -> garbage pointer dereferenced as name string. Reached from DDB stack-trace near syscall entry/exit (exception.S:363 swapgs). DDB-only (privileged). Corrupted disasm output or recovered in-DDB fault (setjmp guard). Fix: extend to 8 entries with _111 at index 7; mask f_reg&0x7.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1032 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited path | 241 B | view raw |
| VERDICT.md | verdict | source-confirmation narrative | 913 B | ↓ raw |
| env.txt | environment | guest uname + toolchain | 247 B | view raw |
DF-1032 source-confirmation
Verdict: REPRODUCED (source-confirmed) Impact: none Confidence: likely
Kernel ref: sys/cpu/x86_64/misc/db_disasm.c:204
Mechanism
db_Grp7_11 OOB read disassembling swapgs/rdtscp: db_Grp7_11 has 6 entries but f_reg returns 7 for modrm 0xF8/0xF9 -> 16-byte OOB read past array. DDB-only; confirmed.
Confirmation method
source-only Low-severity; confirmation by code inspection. Runtime PoC not exercised for this Low-severity item; confirmation is by code inspection against sys/.
Recommended fix
See fix.diff in this folder (git-apply-able unified diff).
Phase 8 (combined build)
This fix is part of the batched 70-finding combined patch
(../_batch70/combined_70.patch) applied to in-guest /usr/src. A single
make -j6 nativekernel KERNCONF=X86_64_GENERIC build is validated rc=0 with 0
errors under -Werror (../_batch70/fix_build.log).
Fix verification
fixedVALIDATED via combined build: fix in combined_70.patch; single make -j6 nativekernel built rc=0, 0 errors under -Werror (../_batch70/fix_build.log). Cited line corrected. Source-only -> validation = clean -Werror compile.
'>>> Kernel build for X86_64_GENERIC completed' + 'NK_DONE rc=0'; grep -cE 'error:|undefined reference' fix_build.log = 0
Confirmed kernel references
- s
- y
- s
- /
- c
- p
- u
- /
- x
- 8
- 6
- _
- 6
- 4
- /
- m
- i
- s
- c
- /
- d
- b
- _
- d
- i
- s
- a
- s
- m
- .
- c
- :
- 2
- 0
- 4
Detail
Exploit chain
none (source-only Low finding, not memory-corruption driven to runtime; no escalation chain)
Evidence (decisive lines)
baseline (with-src #0): bug at sys/cpu/x86_64/misc/db_disasm.c:204. combined-70 fix kernel: NK_DONE rc=0 (0 errors, -Werror).
PoC changes
authored/validated fix.diff (findings/poc/DF-1032/fix.diff); part of combined_70 kernel build.
Verified recommended fix
See findings/poc/DF-1032/fix.diff (git-apply-able). Matches finding proposal.
Verdict
REAL: db_Grp7_11 has 6 entries but f_reg returns 7 for swapgs/rdtscp -> 16-byte OOB read. DDB-only. confirmed.
No comments yet.