DF-0010 — PoC

leak_cmsgcred.c — unprivileged leak of kernel-stack bytes via the uninitialized struct cmsgcred synthesized by SO_PASSCRED.

The issue

uipc_send() (sys/kern/uipc_usrreq.c:680-700), AF_UNIX SOCK_DGRAM, receiver has SO_PASSCRED and sender sent no SCM_CREDS:

struct cmsgcred cred;                 /* :683  uninitialized               */
...
ncon = sbcreatecontrol(&cred, sizeof(cred), SCM_CREDS, SOL_SOCKET); /* :695 */
unp_internalize(ncon, msg->send.nm_td);

sbcreatecontrol copies sizeof(cred) bytes of stack garbage into the mbuf; unp_internalize SCM_CREDS (uipc_usrreq.c:1734-1744) only fills cmcred_pid/uid/euid/gid/ngroups and groups[0..ngroups-1]. The tail groups[ngroups..CMGROUP_MAX-1] (up to 15*4 = 60 bytes) retain the leaked kernel-stack bytes and are delivered to the receiver via recvmsg.

Build

cc -o leak_cmsgcred findings/poc/DF-0010/leak_cmsgcred.c

Run

As an unprivileged user:

./leak_cmsgcred

Expected output (bug present)

sample 0: pid=... uid=... ... ngroups=1
  filled groups [0..0] = { <gid> }
  UNFILLED groups [1..15] = { 0x<..> 0x<..> ... }     <-- leaked kernel stack
result: LEAK CONFIRMED (kernel-stack bytes in unfilled groups)

The unfilled group words vary across runs and are kernel-stack residue (pointer fragments, etc.) — a samplable KASLR/stack-residue oracle. On a fixed kernel they read as zero.

DF-0010 — VERDICT

Verdict: REPRODUCED, FIX VALIDATED. Uninitialized-kernel-stack info leak via SO_PASSCRED synthesis is real on the unpatched #0 master DEV kernel, and is fully closed by the single-line bzero(&cred, sizeof(cred)) fix in fix.diff, confirmed by a clean before/after on a built-and-booted single-fix kernel.

• Impact: info leak, up to ~60 bytes of kernel stack per call including canonical kernel-virtual pointers (KASLR / stack-residue oracle). Low.
• Confidence: certain.
• fix_status: fixed.

Mechanism (trigger -> primitive -> effect)

1. Trigger (unprivileged, self-reachable). An AF_UNIX SOCK_DGRAM socketpair; the receiver end sets SO_PASSCRED; the peer sends a plain datagram with no SCM_CREDS control message. send() -> sosend -> uipc_send.

2. Synthesis from an uninitialized on-stack struct. In uipc_send, sys/kern/uipc_usrreq.c:683 declares c struct cmsgcred cred; /* NO initializer */ inside the if (so2->so_options & SO_PASSCRED) block (:680). When the loop at :687-693 finds no pre-existing SCM_CREDS cmsg (ncon == NULL), the kernel synthesizes one at :694-699: c ncon = sbcreatecontrol(&cred, sizeof(cred), SCM_CREDS, SOL_SOCKET); unp_internalize(ncon, msg->send.nm_td); *mp = ncon;

3. Primitive: full-struct copy of stack garbage. sbcreatecontrol (sys/kern/uipc_sockbuf.c) does memcpy(CMSG_DATA(cp), p, size) with size = sizeof(struct cmsgcred) — it copies all 84 bytes of the uninitialized on-stack cred into the control mbuf.

4. Partial fill leaves the tail unwritten. unp_internalize's SCM_CREDS branch (sys/kern/uipc_usrreq.c:1734-1744) only writes: - cmcred_pid, cmcred_uid, cmcred_gid, cmcred_euid, cmcred_ngroups - cmcred_groups[0..ngroups-1]

It never writes groups[ngroups..CMGROUP_MAX-1] (nor the 2-byte pad after cmcred_ngroups). struct cmsgcred is __pid_t + uid_t*3 + short + pad + gid_t[CMGROUP_MAX] with CMGROUP_MAX = 16, so up to (16-ngroups)*4 + 2 bytes of kernel stack are delivered verbatim to the receiver via recvmsg.

5. Effect: kernel-stack residue leaked to peer. For maxx (ngroups=1), groups[1..15] (60 bytes) plus 2 pad bytes are leaked. Across runs the leaked words vary (different stack residue) and contain canonical kernel-virtual pointers such as 0xfffff800........, 0xfffff801........ — directly defeating KASLR and providing a samplable stack-residue / heap-grooming oracle for a separate kernel bug. No integrity/availability impact (pure info leak).

Baseline reproduction (unpatched #0)

baseline_run.log is the decisive single run on DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026. Representative (sample 0, PID 901):

sample 0: pid=901 uid=1001 euid=1001 gid=1001 ngroups=1
  filled groups [0..0] = { 1001 }
  UNFILLED groups [1..15] = { 0x00000000 0x4063e400 0xfffff800 0x18335688 0xfffff801 0x8065730e 0xffffffff 0x00000005 0x00000000 0x4063e400 0xfffff800 0x183356a8 0xfffff801 0x00000000 0x00000000 }

result: LEAK CONFIRMED (kernel-stack bytes in unfilled groups)
RUN_EXIT=0

The 0xfffff800........ / 0xfffff801........ words are canonical kernel-virtual addresses; they differ across samples/runs, proving genuine uninitialized-memory content rather than cosmetic output. leak_sample.txt holds the prior 3-run variance proof.

Fix validation (Phase 8)

Fix (fix.diff): one line, at the declaration site the finding cites — insert bzero(&cred, sizeof(cred)); immediately after the declaration block (sys/kern/uipc_usrreq.c:683-684), so all 84 bytes of the synthesized struct cmsgcred (including the inter-field pad and the unfilled groups[ngroups..15]) are zeroed before sbcreatecontrol copies them.

Procedure

1. vm.sh reset with-src -> clean source + warm obj + unpatched #0. Baseline re-confirmed leak (above).
2. Applied ONLY fix.diff to /usr/src via patch -p1 --forward -> hunk #1 succeeded at line 683; verified bzero(&cred, sizeof(cred)); now present at uipc_usrreq.c:686.
3. Built single-fix kernel: cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC (background, </dev/null) -> === NK_DONE rc=0 === in fix_build.log (35294 lines). Only uipc_usrreq.o + link re-ran (incremental warm obj).
4. Installed the freshly-stripped kernel over the bare loader name: cp .../kernel.stripped /boot/kernel/kernel (+ .debug), sync. /boot/kernel/kernel sha256 changed 5dc83dac... -> 75d02b7b....
5. Rebooted (vm.sh down && up); sysctl kern.version -> 6.5-DEVELOPMENT #1: Thu Jul 2 18:16:59 UTC 2026 (the #1 build), sha matches the installed binary.

After (patched #1) — fix_run.log, 3 runs / 12 samples

sample 0: pid=829 uid=1001 euid=1001 gid=1001 ngroups=1
  filled groups [0..0] = { 1001 }
  UNFILLED groups [1..15] = { 0x00000000 0x00000000 0x00000000 0x00000000
    0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
    0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 }

result: no residue this run
RUN_EXIT=2          (PoC's "no leak" exit code)

Every unfilled group word is 0x00000000 across all 3 runs — the leak is gone, deterministically. cmcred_pid/uid/euid/gid/groups[0] (the legitimately filled fields) are still correct, so the fix has no functional regression.

Before/after contrast

Conclusion: fix.diff closes the bug (fix_status: fixed). The guest was reset to the with-src (unpatched #0) baseline afterward.

PoC changes

No changes to leak_cmsgcred.c (it was already correct and reproduced on the first run). The only additions to the evidence pack are the fix-validation artifacts: baseline_run.log, fix_build.log, fix_run.log, updated env.txt, this updated VERDICT.md, and an updated manifest.json. fix.diff is unchanged from the prior session (it applied cleanly and compiled).

Exploit chain

Not a memory-corruption class — pure info leak. No further primitive is derivable beyond the samplable ~60-byte kernel-stack oracle (useful as a KASLR/heap-grooming ingredient for a separate bug). Ceiling impact = Low info disclosure, matching the finding's rating.

Recommended fix

fix.diff (git-apply-able, patch -p1 verified to apply and compile, and validated on a booted kernel) inserts bzero(&cred, sizeof(cred)); immediately after the declaration block at sys/kern/uipc_usrreq.c:683-684, zeroing all 84 bytes (including the pad and the unfilled groups[ngroups..15]) before sbcreatecontrol copies them. This matches the finding markdown's ## Recommended fix intent (zero the synthesized cred) and additionally guarantees the 2-byte inter-field padding is cleared (which = {} initialization would not promise portably). Alternative defense-in-depth would be to zero the whole cmcred inside unp_internalize before the partial fill at :1734-1744, but the declaration-site fix is the minimal targeted change at the root location the finding cites.