DF-0006 — PoC

leak_ttys.c — unprivileged leak of kernel function/heap pointers via the kern.ttys sysctl.

The issue

sysctl_kern_ttys() (sys/kern/tty.c:2891-2921) emits each struct tty verbatim:

t = *tp;                                  /* tty.c:2911  whole struct */
if (t.t_dev) t.t_dev = devid_from_dev(..);/* only t_dev sanitized */
SYSCTL_OUT(req, &t, sizeof(t));           /* tty.c:2914 */

struct tty (sys/sys/tty.h) carries kernel .text function pointers (t_oproc/t_stop/t_param/t_unhold → exact KASLR-defeat), kernel heap object pointers (t_pgrp/t_session/t_sigio/t_sc/t_slsc), per-clist c_data buffer pointers, and an embedded lwkt_token. Only t_dev is sanitized. The OID is CTLTYPE_OPAQUE|CTLFLAG_RD (tty.c:2923) and sysctl reads are not privilege-gated (kern_sysctl.c:1446-1450 gates only writes), so any unprivileged local user can dump them all.

Build

cc -o leak_ttys leak_ttys.c      # or: ./build.sh

Run

As an unprivileged user (e.g. maxx, uid 1001):

./leak_ttys       # or: ./run.sh

Expected output (bug present)

got 3760 bytes from kern.ttys
raw blob written to ttys.bin (3760 bytes)
  blob offset   256 (word    32): 0xffffffff80b8b800   <- t_oproc = scstart
  blob offset   264 (word    33): 0xffffffff806b7eb0   <- t_stop  = nottystop
  blob offset   272 (word    34): 0xffffffff80b86930   <- t_param = scparam
  ...
total kernel-range pointer-sized values leaked: 102

The 0xffffffff80???????? values match nm /boot/kernel/kernel symbols exactly (see leak_sample.txt) — proving real kernel .text addresses are leaked and KASLR is defeated. The 0xfffff8?????????? values are live slab / direct-map heap addresses (clist buffers, pgrp/session objects). Stable across runs in the same boot (run.log/run.2.log/run.3.log). On a fixed kernel, zero kernel-range pointers appear and the program exits 2.

Cross-referencing against nm (optional, reproduces the leak_sample.txt table)

nm -n /boot/kernel/kernel > kernel.nm        # world-readable
./leak_ttys                                  # writes ttys.bin
# then for each candidate value, find the nearest nm symbol:
python3 -c "import bisect,struct; ..."       # see leak_sample.txt for results

DF-0006 — kern.ttys sysctl leaks kernel function/heap pointers to unprivileged users

Verdict

REPRODUCED — kern.ttys is world-readable and copies each struct tty verbatim to userland, leaking 102 kernel-range pointer-sized values per read, including exact .text function-pointer addresses that defeat KASLR. Confirmed on DragonFly master DEV v6.5.0.1712.g89e6a-DEVELOPMENT.

Mechanism (confirmed by source + run)

sysctl_kern_ttys (sys/kern/tty.c:2891-2921) iterates the global tty_list and, for each struct tty, does:

t = *tp;                                      /* tty.c:2911  whole-struct copy */
if (t.t_dev)
    t.t_dev = (cdev_t)(uintptr_t)devid_from_dev(t.t_dev);   /* ONLY t_dev sanitized */
error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));            /* tty.c:2914 */

The OID is registered CTLTYPE_OPAQUE|CTLFLAG_RD (tty.c:2923-2924) — a plain read. sysctl_root (sys/kern/kern_sysctl.c:1446-1450) applies its privilege check (caps_priv_check(.., SYSCAP_NOSYSCTL_WR)) only when req->newptr is set (a write). A read sets no newptr, so no privilege check runs; any unprivileged user reads kern.ttys.

struct tty (sys/sys/tty.h) carries, all copied raw: - .text function pointers t_oproc / t_stop / t_param / t_unhold (lines 94-99) - kernel heap pointers t_pgrp (86), t_session (87), t_sigio (88), t_sc (100), t_slsc (101) - per-clist data-buffer pointers t_rawq.c_data / t_canq.c_data / t_outq.c_data (line 50) - an embedded lwkt_token t_token (74)

Only t_dev (82) is rewritten before copyout.

Proof

./leak_ttys run as maxx (uid 1001, not in wheel) returns 3760 bytes (10 ttys × 376-byte struct tty) and scans 102 kernel-range pointers. Cross-referencing the leaked .text values against nm /boot/kernel/kernel (also world-readable) yields exact symbol matches:

Plus heap pointers in the 0xfffff8xxxxxxxxxx direct-map region (clist c_data buffers, t_pgrp/t_session slab objects, the global token at intra-off 352). Stable across 3 reads in the same boot (see run.log/run.2.log/run.3.log).

Because the leaked function-pointer values equal the static nm addresses, this build has no KASLR slide on the tty ops — an attacker recovers the exact kernel .text base and heap layout from an unprivileged account.

Impact

Information disclosure: precise kernel .text base + kernel heap layout to any local unprivileged user. Not a memory-corruption primitive itself, but it is a KASLR-defeat and slab-grooming enabler that escalates the practical severity of any local heap/stack corruption bug into reliable exploitation. Rated Low standalone (info disclosure, no integrity/availability impact).

Is the node world-readable? (privilege-gate trace)

Yes. The OID at sys/kern/tty.c:2923 is CTLFLAG_RD with no CTLFLAG_ANYBODY needed (that flag is write-only). sysctl_root (kern_sysctl.c:1446-1450) gates only writes:

if (!(oid->oid_kind & CTLFLAG_ANYBODY) && req->newptr && p &&
    (error = caps_priv_check(td->td_ucred, SYSCAP_NOSYSCTL_WR)))
    return (error);

req->newptr is NULL on reads, so the branch is skipped. kern.ttys is readable by maxx (verified). No per-handler privilege check exists in sysctl_kern_ttys. → the gate that would prevent the leak is absent on master.

PoC changes

Rewrote leak_ttys.c: the original used the wrong kernel-address range (>= 0xffffffff80000000) which misses the DragonFly direct-map/heap region (0xfffff8xxxxxxxxxx) where most of the pointers live, and printed only a subset. The new version detects the full canonical kernel upper half (>= 0xffff800000000000), prints up to 60 candidates, and dumps the raw blob to ttys.bin so the leaked function pointers can be cross-referenced against nm /boot/kernel/kernel (done in leak_sample.txt). Added build.sh/run.sh.

Recommended fix

Matches the finding markdown's proposal. Authoritative fix.diff in this folder zeros all pointer fields of the local copy before SYSCTL_OUT while preserving t_dev sanitization and every field pstat(8) reads. A stronger long-term fix is a dedicated pointer-free struct kinfo_tty (mirroring kinfo_file).