⬢ DragonFlyBSD Kernel Audit
DF-2927 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-2927",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Unprivileged local users (verified uid=1001 on the stock audit guest) can read sysctl debug.dump_modinfo because DragonFly's sysctl layer gates only writes (kern_sysctl.c:1445-1448), and the handler (subr_module.c:429-445) performs no credential check — unlike the comparable sysctl.sysctl_debug dumper which is gated by SYSCAP_NODEBUG_UNPRIV (kern_sysctl.c:649). The dump discloses the KVA of every metadata TLV (%p, subr_module.c:411), the kernel base (MODINFO_ADDR = 0xffffffff80200000), the load addresses of every loader-preloaded module (ehci.ko @ 0xffffffff81cd9000, xhci.ko @ 0xffffffff81d56000), the exact kernel symbol-table range (SSYM 0xffffffff81b25e40 / ESYM 0xffffffff81cd8538), _DYNAMIC (0xffffffff80fce540), the static boot-environment block address (ENVP 0x1de3000 — the memory kern_envp walks, cf. DF-2894), and KERNEND (0x1de6000). Output is deterministic (identical MD5 across 3 reads). Not memory corruption; ceiling is a reliable kernel-memory-layout disclosure that defeats KASLR-style hardening and aids targeting of adjacent bugs; stock DF pc64 has no kernel-base randomization today, capping severity at Low.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-2927/run.log — uid=1001 receives the full 26-TLV dump, exit 0",
    "findings/poc/DF-2927/run.2.log — 3 consecutive reads, identical MD5 242807fbad7a6d778cfb0f46fd458a32",
    "findings/poc/DF-2927/leak_sample.txt — full dump with kernel base / SSYM / ESYM / DYNAMIC / ENVP / KERNEND values"
  ],
  "kernel_refs": [
    "sys/kern/subr_module.c:411",
    "sys/kern/subr_module.c:373-385",
    "sys/kern/subr_module.c:429-450",
    "sys/kern/kern_sysctl.c:1436-1448",
    "sys/kern/kern_sysctl.c:649"
  ],
  "poc_changes": "No seed PoC existed; wrote run.sh/build.sh from scratch (trigger is a stock userland binary — nothing to fix or compile).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "./build.sh (no-op)",
  "run_cmd": "./run.sh  (guest: sysctl -n debug.dump_modinfo as uid 1001)",
  "code_hash": "8085306c9ff3e57669b3e9557536320e73eb31c532cc97dcd61cb6d4700a23ad",
  "notes": "Read path has NO privilege gate: kern_sysctl.c gates writes only (SYSCAP_NOSYSCTL_WR on req->newptr) and CTLFLAG_SECURE suppresses writes at securelevel>0; securelevel was -1 on the guest. The SYSCAP_NODEBUG_UNPRIV gate exists but is applied only to sysctl.sysctl_debug (:649), not to children of the debug top-level node. Guest left up and healthy (only /tmp scratch files written); no reset needed.",
  "recommended_fix": "Gate sysctl_preload_dump with the same capability check used for sysctl.sysctl_debug: caps_priv_check_td(req->td, SYSCAP_NODEBUG_UNPRIV) returning on error (plus #include <sys/caps.h>).",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Kernel rebuild not performed: fix validation rebuilds are mandated for reproduced memory-corruption findings; this is a Low info-disclosure gated by a one-line permission check that mirrors the proven existing gate at sys/kern/kern_sysctl.c:649 verbatim. fix.diff applies clean against sys/kern/subr_module.c (git apply --check verified); post-fix expectation is EPERM for non-root and unchanged root output.",
  "fix_evidence": "findings/poc/DF-2927/fix.diff (git-apply-able, applies clean; never applied to sys/)"
}