DF-0010 — PoC

leak_cmsgcred.c — unprivileged leak of kernel-stack bytes via the uninitialized struct cmsgcred synthesized by SO_PASSCRED.

The issue

uipc_send() (sys/kern/uipc_usrreq.c:680-700), AF_UNIX SOCK_DGRAM, receiver has SO_PASSCRED and sender sent no SCM_CREDS:

struct cmsgcred cred;                 /* :683  uninitialized               */
...
ncon = sbcreatecontrol(&cred, sizeof(cred), SCM_CREDS, SOL_SOCKET); /* :695 */
unp_internalize(ncon, msg->send.nm_td);

sbcreatecontrol copies sizeof(cred) bytes of stack garbage into the mbuf; unp_internalize SCM_CREDS (uipc_usrreq.c:1734-1744) only fills cmcred_pid/uid/euid/gid/ngroups and groups[0..ngroups-1]. The tail groups[ngroups..CMGROUP_MAX-1] (up to 15*4 = 60 bytes) retain the leaked kernel-stack bytes and are delivered to the receiver via recvmsg.

Build

cc -o leak_cmsgcred findings/poc/DF-0010/leak_cmsgcred.c

Run

As an unprivileged user:

./leak_cmsgcred

Expected output (bug present)

sample 0: pid=... uid=... ... ngroups=1
  filled groups [0..0] = { <gid> }
  UNFILLED groups [1..15] = { 0x<..> 0x<..> ... }     <-- leaked kernel stack
result: LEAK CONFIRMED (kernel-stack bytes in unfilled groups)

The unfilled group words vary across runs and are kernel-stack residue (pointer fragments, etc.) — a samplable KASLR/stack-residue oracle. On a fixed kernel they read as zero.

DF-0010 — VERDICT

Verdict: REPRODUCED (uninitialized-kernel-stack info leak via SO_PASSCRED synthesis). Impact: info leak, up to ~60 bytes of kernel stack per call including canonical kernel-virtual pointers (KASLR/stack-residue oracle). Confidence: certain.

Mechanism (trigger → primitive → effect)

1. Trigger (unprivileged, self-reachable). An AF_UNIX SOCK_DGRAM socketpair; the receiver end sets SO_PASSCRED; the peer sends a plain datagram with no SCM_CREDS control message. send() → sosend → uipc_send.

2. Synthesis from an uninitialized on-stack struct. In uipc_send, sys/kern/uipc_usrreq.c:683 declares c struct cmsgcred cred; /* NO initializer */ inside the if (so2->so_options & SO_PASSCRED) block (:680). When the loop at :687-693 finds no pre-existing SCM_CREDS cmsg (ncon == NULL), the kernel synthesizes one at :694-699: c ncon = sbcreatecontrol(&cred, sizeof(cred), SCM_CREDS, SOL_SOCKET); unp_internalize(ncon, msg->send.nm_td); *mp = ncon;

3. Primitive: full-struct copy of stack garbage. sbcreatecontrol (sys/kern/uipc_sockbuf.c:585-604) does memcpy(CMSG_DATA(cp), p, size) with size = sizeof(struct cmsgcred) = 84 (:598) — it copies all 84 bytes of the uninitialized on-stack cred into the control mbuf.

4. Partial fill leaves the tail unwritten. unp_internalize's SCM_CREDS branch (sys/kern/uipc_usrreq.c:1734-1744) only writes: - cmcred_pid, cmcred_uid, cmcred_gid, cmcred_euid, cmcred_ngroups (:1736-1741) - cmcred_groups[0..ngroups-1] (:1742-1743)

It never writes groups[ngroups..CMGROUP_MAX-1] (nor the 2-byte pad after cmcred_ngroups). struct cmsgcred (sys/sys/socket.h:431-438) is __pid_t + uid_t*3 + short + pad + gid_t[CMGROUP_MAX] with CMGROUP_MAX = 16 (sys/sys/socket.h:422), so up to (16 - ngroups)*4 + 2 bytes of kernel stack are delivered verbatim to the receiver via recvmsg.

5. Effect: kernel-stack residue leaked to peer. For maxx (ngroups=1), groups[1..15] (60 bytes) plus 2 pad bytes are leaked. Across runs the leaked words vary (different stack residue) and contain canonical kernel-virtual pointers such as 0xfffff8006687a5a0, 0xfffff800ab9d5688, 0xfffff800aba73688 — directly defeating KASLR and providing a samplable stack-residue / heap-grooming oracle for a separate kernel bug. No integrity/availability impact (pure info leak).

Evidence (decisive)

leak_sample.txt holds three independent runs (PIDs 838 / 933 / 938 … on different boots). Representative (PID 838, run 1):

sample 0: pid=838 uid=1001 euid=1001 gid=1001 ngroups=1
  filled groups [0..0] = { 1001 }
  UNFILLED groups [1..15] = { 0x00000000 0x4060d100 0xfffff800 0xaba73688
    0xfffff800 0x80656a1e 0xffffffff 0x00000005 0x00000000 0x4060d100
    0xfffff800 0xaba736a8 0xfffff800 0x00000000 0x00000000 }

The 0xfffff800........ words are canonical kernel-virtual addresses (the kernel text/data range). They differ across PIDs/runs, proving genuine uninitialized-memory content rather than cosmetic output. result: LEAK CONFIRMED on every run; exit code 0. run.log is the decisive single run.

PoC changes

The seeded leak_cmsgcred.c was already correct and compiled/run unchanged (no source edits were needed). It builds clean with cc -o leak_cmsgcred leak_cmsgcred.c and reproduces on the first run.

Exploit chain

Not a memory-corruption class — pure info leak. No further primitive is derivable beyond the samplable ~60-byte kernel-stack oracle (useful as a KASLR/heap-grooming ingredient for a separate bug). Ceiling impact = Low info disclosure, matching the finding's rating.

Recommended fix

fix.diff (git-apply-able, git apply --check verified) inserts bzero(&cred, sizeof(cred)); immediately after the declaration block at sys/kern/uipc_usrreq.c:683-684, zeroing all 84 bytes (including the pad and the unfilled groups[ngroups..15]) before sbcreatecontrol copies them. This matches the finding markdown's ## Recommended fix intent (zero the synthesized cred) and additionally covers the 2-byte inter-field padding that = {} initialization would not guarantee to clear. Alternative defense-in-depth would be to zero the whole cmcred inside unp_internalize before the partial fill at :1734-1744, but the declaration-site fix is the minimal targeted change at the root location the finding cites.