⬢ DragonFlyBSD Kernel Audit
DF-5150 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-5150",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Structural teardown gap confirmed in source and probed at runtime, but the UAF half is not reachable on any current configuration, so the security impact today is none. acpi_lid_attach() installs AcpiInstallNotifyHandler(..., ACPI_DEVICE_NOTIFY, acpi_lid_notify_handler, sc) with context = softc (sys/dev/acpica/acpi_lid.c:121-122), enables the PRW wake GPE (acpi_lid.c:126-127), defers sc via AcpiOsExecute (acpi_lid.c:194-195), and the driver has no device_detach (acpi_lid.c:66-74) -- the exact DF-5091 (acpi_button) mirror flagged in that findings notes (acpi_lid.c (PNP0C0D) ... filed separately). On the guest: the acpi_lid driver is registered in the builtin kernel (kldstat -v id 274), no acpi_lid device instance is attached (dmesg empty), and QEMUs DSDT contains zero PNP0C0D entries (acpidump), so the handler is never even installed here; kldunload acpi fails (cant find file), and in a module build unloading acpi.ko aborts at bus_generic_detach (acpi.c:182) -> missing child detach -> ENXIO before any softc is freed. Net effect today: permanently pinned handler/GPE if the hardware exists, and a guaranteed UAF (notify -> AcpiOsExecute(sc) -> freed softc) if a detach path is ever added. Low severity, fix is cheap and belongs in-tree.",
  "exploit_chain": "",
  "evidence": "run.log (decisive: kldstat -v | grep -i lid shows acpi/acpi_lid registered; dmesg | grep -i lid empty; acpidump -d | grep -c PNP0C0D = 0; sysctl hw.acpi.lid_switch_state belongs to acpi.c:630 not this driver; kldunload acpi fails cant find file acpi; guest stays up). VERDICT.md for the full path:line trace plus the pass-2 killed candidates (sysctl ownership, _LID failure path, suspend/resume no-ops, wake-GPE pattern, notify default case); fix.diff for the proposed detach (git apply --check clean, not applied).",
  "kernel_refs": [
    "sys/dev/acpica/acpi_lid.c:66",
    "sys/dev/acpica/acpi_lid.c:121",
    "sys/dev/acpica/acpi_lid.c:126",
    "sys/dev/acpica/acpi_lid.c:161",
    "sys/dev/acpica/acpi_lid.c:194",
    "sys/dev/acpica/acpi.c:182",
    "sys/dev/acpica/acpi.c:630"
  ],
  "poc_changes": "None -- structural finding; trigger is a plain /bin/sh runtime demonstration (driver registration, device absence, absent DSDT node, blocked unload), no seed code to repair.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "none (structural kernel-source finding; ./build.sh only syntax-checks trigger.sh)",
  "run_cmd": "findings/poc/DF-5150/run.sh  (vm.sh run_root executes trigger.sh as root on the guest)",
  "code_hash": "26289286bcde4ae7e1c03614feb7e7c89c90537280b6ab4ee2b6e563b7412cec",
  "notes": "Guest left up and clean (all probes read-only; kldunload attempt failed benignly; no panic). Family: DF-5006 (acpi_cpu), DF-5074 (acpi_acad), DF-5091 (acpi_button) -- this is the acpi_lid (PNP0C0D) instance explicitly anticipated by DF-5091s notes. No prior findings existed for acpi_lid.c. hw.acpi.lid_switch_state and acpi_sleep_event/acpi_wakeup_event consumers live in acpi.c, not this driver.",
  "recommended_fix": "Add acpi_lid_detach() mirroring attach (AcpiRemoveNotifyHandler for ACPI_DEVICE_NOTIFY; acpi_wake_set_enable(dev,0); AcpiDisableGpe for the PRW GPE) and register DEVMETHOD(device_detach, ...) -- see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and git apply --check clean against sys/ but not build-validated: the finding produced no runtime fault on the baseline guest (structurally non-UAF today; no acpi_lid device, no PNP0C0D in the QEMU firmware, no unload path), so there is no bad behavior to A/B. Fix validation is mandatory only when a memory-corruption finding reproduces.",
  "fix_evidence": "findings/poc/DF-5150/fix.diff (proposed, unapplied; adds acpi_lid_detach() + DEVMETHOD entry; notes the AcpiOsExecute drain requirement)"
}