⬢ DragonFlyBSD Kernel Audit
DF-3476 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-3476",
  "status": "untested",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "likely",
  "verdict": "ng_btsocket_rfcomm_process_timeout() (ng_btsocket_rfcomm.c:3554) blocks acquiring pcb->pcb_lock while running as a callout callback (CALLOUT_INPROG held, kern_timeout.c:567); ng_btsocket_rfcomm_untimeout() -> callout_stop() is synchronous on DragonFly (kern_timeout.c:1091, :910-921) and is invoked while HOLDING pcb_lock at five sites (:769, :835, :2112, :2273, :3404). Timer expiry inside any of those pcb_lock critical sections therefore produces a non-interruptible AB-BA circular wait: softclock thread + triggering thread (task or user close()) wedge permanently; the RFCOMM task and one CPUs callout wheel stop. Remote Bluetooth peer can aim the window (UA/SABM/DISC at DLC-timer expiry, 60s default); local user can aim close() at timer expiry. Not executable on the audit guest (no Bluetooth hardware: L2CAP session establishment fails before any DLC timer is armed - verified), hence untested; mechanism is fully source-proven with the exact sleep conditions quoted from kern_timeout.c.",
  "exploit_chain": "attacker (remote BT peer or local socket owner) <-> DLC timer expiry races pcb_lock critical section -> callback blocked on pcb_lock <-> callout_stop blocked on callback return -> permanent kernel wedge (unkillable user thread, RFCOMM task halted, softclock thread of one CPU halted) until reboot.",
  "evidence": [
    "findings/poc/DF-3476/README.md \u2014 full interleaving diagram + trigger analysis",
    "findings/poc/DF-3476/VERDICT.md \u2014 why untested on guest + source trace",
    "sys/kern/kern_timeout.c:567,630,644 (INPROG spans the callback)",
    "sys/kern/kern_timeout.c:888-921 (callout_stop sleeps until callback completes)",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3554 (callback blocks on pcb_lock)",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3404 (untimeout under pcb_lock+session_lock)"
  ],
  "kernel_refs": [
    "sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3554",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3538",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3404",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:835",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:769",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:2112",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:2273",
    "sys/kern/kern_timeout.c:888",
    "sys/kern/kern_timeout.c:910"
  ],
  "poc_changes": "n/a - no PoC written: trigger requires Bluetooth hardware (RFCOMM DLC timer can only be armed on an L2CAP-connected session; guest has no HCI device). Analysis-only evidence pack.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Impact ceiling is a permanent system wedge (DoS), remotely aimable by a paired/range Bluetooth peer or locally by the socket owner; Medium severity (requires BT hardware + active RFCOMM session, non-default on servers). Sibling risks noted but not filed: sbappend/ssb_space on so_rcv/so_snd from the RFCOMM task thread without ssb_token (receive_uih:2445-2462, send:1050) - the files own XXX FIXME acknowledges unspecified l2so/socket locking; and session_receives sio.sb_mb NULL-deref (:1676) if a zero-length L2CAP record is delivered. Both likewise need BT hardware to exercise.",
  "recommended_fix": "Make process_timeout() non-blocking: set TIMEDOUT without taking pcb_lock and move the state transition into the RFCOMM task under pcb_lock (fix.diff); alternatively never call untimeout() while holding pcb_lock."
}