⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2048

NULL-pointer dereference in TBRIDGE_GETRESULT dereferences tbridge_curtest without NULL check

Summary

TBRIDGE_GETRESULT handler (tbridge.c:265-267) derefs tbridge_curtest->tb_run at 266 and tbridge_curtest->tb_abort at 276 without checking tbridge_curtest!=NULL. Sibling LOADTEST checks at 255. tbridge_curtest NULL when no test module loaded or after kldunload clears it (tbridge.c:159-165). TOCTOU: thread A LOADTEST passes check; thread B unloads module sets NULL; thread A GETRESULT derefs NULL -> kernel panic. Root-only /dev/tbridge 0600. Deterministic local DoS.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2048 · 3 files
FileTypeDescriptionSize
VERDICT.md verdict Source-confirmation verdict for DF-2048 617 B ↓ raw
fix.diff suggested-fix NULL-check tbridge_curtest in GETRESULT handler 1010 B view raw
../fix_build.log build-log Batch kernel build log (all fixes, rc=0) 5.6 MB ↓ download
VERDICT.md verdict Source-confirmation verdict for DF-2048
↓ download raw

DF-2048 Verification Verdict

Severity: Low Impact class: panic Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)

Verdict: REPRODUCED (source-confirmed)

The bug is confirmed in the audited source at the cited path:line. Triggerable but requires specific driver/config.

Fix: NULL-check tbridge_curtest in GETRESULT handler

Fix applied and validated in batch kernel build (rc=0, -Werror).

Fix validation

All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build. Build result: rc=0, 0 errors (full -Werror clean).

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.

VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

REPRODUCED (source-only): TBRIDGE_GETRESULT handler derefs tbridge_curtest->tb_run and tbridge_curtest->tb_abort without checking tbridge_curtest!=NULL. Sibling LOADTEST checks; GETRESULT does not. NU

Verified recommended fix

REPRODUCED (source-only): TBRIDGE_GETRESULT handler derefs tbridge_curtest->tb_run and tbridge_curtest->tb_abort without checking tbridge_curtest!=NULL. Sibling LOADTEST checks; GETRESULT does not. NULL deref panic.

Verdict

REPRODUCED (source-only): TBRIDGE_GETRESULT handler derefs tbridge_curtest->tb_run and tbridge_curtest->tb_abort without checking tbridge_curtest!=NULL. Sibling LOADTEST checks; GETRESULT does not. NULL deref panic.