⬢ DragonFlyBSD Kernel Audit
DF-5006 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-5006",
  "title": "acpi_cpu has no detach teardown: ACPI notify handler (context=sc), sysctl contexts and sensordev outlive the softc -> UAF on driver/module detach; attach error paths leak them",
  "verdict": "untested",
  "impact": "none (not exercised; latent UAF gated on privileged module unload)",
  "reproduce": {
    "build": "n/a — requires a kernel with acpi built as a module",
    "run": "kldunload acpi (as root, module-built acpi) followed by any ACPI 0x80/0x81 cpu notify or 'sysctl hw.acpi.cpu.cx_lowest'",
    "expected": "use-after-free in acpi_cpu_notify / sysctl handler over freed softc (panic expected); NOT executable on the audit guest (acpi compiled-in, env_probe.txt)"
  },
  "kernel_refs": [
    "sys/dev/acpica/acpi_cpu.c:67",
    "sys/dev/acpica/acpi_cpu.c:171",
    "sys/dev/acpica/acpi_cpu.c:180",
    "sys/dev/acpica/acpi_cpu.c:233",
    "sys/dev/acpica/acpi_cpu.c:236",
    "sys/dev/acpica/acpi_cpu.c:243",
    "sys/dev/acpica/acpi_cpu.c:252",
    "sys/dev/acpica/acpi_cpu.c:324",
    "sys/dev/acpica/acpi_cpu_cstate.c:751",
    "sys/kern/subr_bus.c:1941"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fix.diff", "env_probe.txt", "manifest.json", "verdict.json"
  ]
}