DF-0020 — PoC

elf_note_oob.c (C; the seed was elf_note_oob.py — rewritten in C because the DragonFly guest has no python3) crafts a minimal ELF64 whose truncated .note.ABI-tag triggers a kernel OOB read in bsd_trans_osrel().

The bug

note_overflow() (sys/kern/imgact_elf.c:1700-1707) validates that a note's n_namesz fits in the remaining PT_NOTE segment but never validates n_descsz. A crafted PT_NOTE that matches the DragonFly brandnote (n_namesz=10, n_descsz=4, n_type=1, vendor "DragonFly") but is truncated (p_filesz=22, no descriptor) passes note_overflow (12<=22, 10<=10), matches, and bsd_trans_osrel() reads the 4-byte descriptor at note + sizeof(Elf_Note) + roundup2(n_namesz, 4) == note+24 — past the 22-byte segment, and with noteloc=4072, past the 4096-byte image_header page entirely. OOB read of adjacent kernel memory.

Impact: kernel OOB read of ≤4 bytes; value goes to p_osrel (not exposed to userspace) → no info leak, no escalation. Realistic ceiling is a silent OOB read on every local execve (robustness / defense-in-depth) or, if the OOB straddles an unmapped page, a local DoS via page-fault panic.

Why EI_OSABI = 200

The PoC sets e_ident[EI_OSABI] = 200 so the brand can ONLY be selected via the PT_NOTE match path (loop 1 in get_brandinfo, sys/kern/imgact_elf.c:550-561). With EI_OSABI=0 (the seed value), loop 2's hdr->e_ident[EI_OSABI] == bi->brand match would select the DragonFly brand regardless of whether the note check passed, masking the bug. With EI_OSABI=200 and kern.elf64.fallback_brand=-1, the unfixed kernel accepts the binary (note match + OOB), while the fixed kernel rejects it with ENOEXEC — a clean before/after contrast.

Why noteloc = 4072 (not 4074)

The seed Python PoC used noteloc = 4096 - 22 = 4074, but 4074 % 4 = 2, and the note walk breaks immediately on !aligned(note, Elf32_Addr) (sys/kern/imgact_elf.c:1778). With noteloc=4072 (4-aligned), the walk proceeds past the alignment check, the truncated note matches, and bsd_trans_osrel performs the OOB read.

Build (unprivileged)

cc -O2 -Wall -o elf_note_oob elf_note_oob.c

(or just ./build.sh)

Run (unprivileged)

./run.sh
# equivalent to:
./elf_note_oob /tmp/df0020_oob_elf
chmod +x /tmp/df0020_oob_elf
/tmp/df0020_oob_elf

Expected output

Bug present (unpatched #0 kernel)

execve succeeds: the crafted binary is loaded via the OOB brand match. Since the binary has no PT_LOAD, control jumps to e_entry=0 and the new process dies with SIGSEGV:

--- attempting execve ---
Segmentation fault (core dumped)            # execve succeeded

The shell does NOT print "Exec format error". (5/5 reproducible; OOB read happens silently each time — adjacent lwbuf-pool page is mapped.)

Fixed kernel (this fix.diff applied)

execve fails with ENOEXEC. The shell prints:

--- attempting execve ---
./run.sh: /tmp/df0020_oob_elf: Exec format error

No SIGSEGV, no OOB read. (3/3 reproducible.)

Files

DF-0020 — ELF ABI-note descriptor read out of bounds (note_overflow ignores n_descsz)

Verdict

REPRODUCED. The bug is real and confirmed by both source-level tracing and an empirical before/after contrast on the running kernel. The fix (fix.diff) closes the bug deterministically (validated on a built-and- booted single-fix kernel). Impact is a kernel OOB read of ≤4 bytes adjacent to a per-exec scratch buffer; the read value goes to p_osrel and is not exposed to userspace, so the realistic impact ceiling is a silent OOB read on every local execve(2) of a crafted binary — i.e. defense-in-depth / robustness — with a possible local DoS (page-fault panic) if the OOB read straddles an unmapped page boundary. No privilege escalation is derivable (no write primitive, value not exposed).

Mechanism (trigger → primitive → effect)

The image activator walks an ELF's PT_NOTE program header looking for the DragonFly ABI brandnote (sys/kern/imgact_elf.c:1670-1693, check_note → check_PT_NOTE). For each candidate note it calls note_overflow(note, maxsize) (:1700-1707) to validate that the note header + name fit in the remaining segment:

static boolean_t
note_overflow(const Elf_Note *note, size_t maxsize)
{
    if (sizeof(*note) > maxsize)
        return TRUE;
    if (note->n_namesz > maxsize - sizeof(*note))   /* checks namesz only */
        return TRUE;
    return FALSE;                                    /* n_descsz never checked */
}

n_descsz is never validated. The note-walk match (:1786-1790) requires note->n_descsz == checknote->hdr.n_descsz (4 for the DragonFly brandnote, :131), so a truncated note whose 12-byte header claims n_descsz=4 but whose segment truncates the descriptor passes note_overflow, matches, and reaches the BN_TRANSLATE_OSREL callback bsd_trans_osrel (:1791-1794):

static boolean_t
__elfN(bsd_trans_osrel)(const Elf_Note *note, int32_t *osrel)
{
    uintptr_t p;
    p = (uintptr_t)(note + 1);                          /* +12 (sizeof Elf_Note) */
    p += roundup2(note->n_namesz, sizeof(Elf32_Addr));  /* +12 (roundup2(10,4))  */
    *osrel = *(const int32_t *)(p);                     /* :1872  reads note+24   */
    return (TRUE);
}

The dereference at note + 24 reads 4 bytes (note+24..note+28) — but the segment buffer ends at note + 22 (12-byte header + 10-byte name, no descriptor), so the read lands 2–6 bytes past note_end and, in this PoC's placement, past the entire 4096-byte mapped lwbuf page.

Buffer placement (this PoC)

noteloc = 4072, p_filesz = 22 → endbyte = 4094 < PAGE_SIZE, so limited_to_first_page is TRUE and the note pointer resolves into imgp->image_header (a single 4096-byte page mapped by exec_map_first_page → exec_map_page → lwbuf, sys/kern/kern_exec.c:850-867). With note = image_header + 4072:

Why the OOB is silent on this guest

image_header is mapped by lwbuf, which on DragonFly uses a per-CPU sf_buf-style KVA window. The virtual page adjacent to the lwbuf mapping is usually another mapped page, so the 4-byte OOB read silently returns adjacent kernel memory rather than faulting. The read value lands in p_osrel (sys/kern/imgact_elf.c:867) and is never copied to userspace via auxargs, so there is no info leak as a direct consequence. Depending on guest memory layout / system load, the OOB read may instead fault on an unmapped page → kernel page-fault panic (local DoS).

Why the PoC uses EI_OSABI = 200

get_brandinfo (sys/kern/imgact_elf.c:534-599) tries four selection paths in order: (1) PT_NOTE brand match, (2) EI_OSABI / OLD_EI_BRAND match, (3) interpreter-path match, (4) default fallback brand. The DragonFly brand has .brand = ELFOSABI_NONE (0) and .flags = BI_CAN_EXEC_DYN | BI_BRAND_NOTE (not MANDATORY) (sys/cpu/x86_64/misc/elf_machdep.c:58-68).

If the PoC set EI_OSABI = 0 (the original elf_note_oob.py value), loop (2) would also match the DragonFly brand regardless of whether the PT_NOTE check passed — masking the bug behaviorally. With EI_OSABI = 200 (an obscure value no registered brand matches) and no PT_INTERP, the only path that can select a brand is loop (1) — the PT_NOTE match. Combined with kern.elf64.fallback_brand = -1 (default, verified), this yields a clean, deterministic contrast:

The "execve succeeds on unfixed, fails on fixed" difference is the decisive before/after evidence: the only thing that changed is whether the truncated PT_NOTE passes note_overflow — i.e. whether the OOB descriptor read happens.

Exploit chain

None — this is a read-only primitive. The leaked bytes go to p_osrel, which is not exposed to userspace through auxargs or any other copyout path. No write primitive is derivable; no privilege escalation is possible from this bug alone. The realistic impact ceiling is:

1. Silent kernel OOB read (4 bytes) on every local execve of a crafted binary — defense-in-depth / robustness concern; the OOB value is attacker-influenced only via the position of the note within the segment, not its content (the descriptor bytes are read from adjacent kernel memory, which the attacker does not control).
2. Local DoS via page-fault panic if the OOB read straddles an unmapped kernel VA page. Reproducibility of this depends on guest memory layout (lwbuf-pool adjacency) and is not deterministic.

A secondary combinator: if an attacker already has a separate primitive that places attacker-controlled bytes adjacent to the lwbuf pool, this read could be used as a controlled info-leak side channel. Standalone, no escalation.

PoC changes (vs. the seed elf_note_oob.py)

1. Rewrote the generator in C (elf_note_oob.c) because the guest has no python3. The C version emits byte-identical bytes to the Python PoC for the same parameters and is self-contained.
2. Changed EI_OSABI from 0 to 200 so brand selection can ONLY happen via the PT_NOTE path (see "Why the PoC uses EI_OSABI = 200" above). This turns an ambiguous silent OOB into a clean before/after contrast (execve succeeds vs ENOEXEC).
3. Changed noteloc from 4074 to 4072 (4-byte aligned) so the aligned(note, Elf32_Addr) check at imgact_elf.c:1778 does not immediately break the note walk before the match. (4074 % 4 = 2, which would silently break the walk and make the PoC ineffective.)
4. Added build.sh / run.sh repro scripts and full untrimmed logs (build.log, run.log, run.2.log, fix_build.log, fix_run.log, env.txt).

Fix

fix.diff (this folder) — sys/kern/imgact_elf.c:1700 note_overflow. Add an n_descsz-aware bounds check that avoids underflow:

static boolean_t
note_overflow(const Elf_Note *note, size_t maxsize)
{
    size_t avail, need;

    if (sizeof(*note) > maxsize)
        return TRUE;
    avail = maxsize - sizeof(*note);
    if (note->n_namesz > avail)
        return TRUE;
    /*
     * The descriptor (and rounded name) must also fit inside the
     * remaining segment, otherwise a caller that dereferences the
     * descriptor (e.g. bsd_trans_osrel()) would read past the end of
     * the validated note buffer.
     */
    need = roundup2(note->n_namesz, sizeof(Elf32_Addr)) +
        roundup2(note->n_descsz, sizeof(Elf32_Addr));
    if (need > avail)
        return TRUE;
    return FALSE;
}

need is computed by addition (no underflow) and compared against avail, which is the post-header bytes remaining. For the PoC's truncated note (n_namesz=10, n_descsz=4, maxsize=22): need = roundup2(10,4) + roundup2(4,4) = 12 + 4 = 16 > avail=10 ⇒ returns TRUE, breaking the walk before the match — no OOB.

This supersedes the finding markdown's proposed fix. The markdown's version used avail -= roundup2(note->n_namesz, sizeof(Elf32_Addr)) which, when roundup2(n_namesz,4) > avail (true for n_namesz=10, avail=10: rounded is 12), underflows the size_t to a huge value and the subsequent n_descsz > avail check silently passes — i.e. the markdown's proposed fix would NOT close the bug for this PoC. The first single-fix kernel I built with that shape confirmed this: the PoC still triggered the OOB (Segmentation fault, execve succeeded). The corrected need = a + b; need > avail form is underflow-proof and was re-validated from scratch on a freshly-built #1 kernel.

Fix validation (Phase 8)

Built a single-fix kernel with make -j6 nativekernel KERNCONF=X86_64_GENERIC from the with-src snapshot + this fix.diff applied. Booted it as /boot/kernel/kernel (the bare name the loader boots). Confirmed kern.version = DragonFly 6.5-DEVELOPMENT #1: Sun Jul 12 16:48:55 UTC 2026 (build timestamp today, #1 vs the unpatched #0).

Ran the same PoC on both kernels:

5/5 baseline runs succeeded (OOB silent each time, no panic); 3/3 patched runs failed cleanly with ENOEXEC. Deterministic before/after.

Kernel references (confirmed during verification)

• sys/kern/imgact_elf.c:1700-1707 — note_overflow (does not check n_descsz).
• sys/kern/imgact_elf.c:127-136 — DragonFly brandnote definition (n_descsz = sizeof(int32_t) = 4, BN_TRANSLATE_OSREL).
• sys/kern/imgact_elf.c:1780-1781 — caller (note_overflow(note, note_end - note)).
• sys/kern/imgact_elf.c:1786-1794 — match + bsd_trans_osrel invocation.
• sys/kern/imgact_elf.c:1866-1875 — bsd_trans_osrel deref at note + sizeof(Elf_Note) + roundup2(n_namesz, 4).
• sys/kern/imgact_elf.c:534-599 — get_brandinfo's 4 selection loops (why EI_OSABI=200 is needed).
• sys/cpu/x86_64/misc/elf_machdep.c:58-68 — DragonFly brand .brand = ELFOSABI_NONE, BI_BRAND_NOTE.
• sys/kern/kern_exec.c:850-867 — exec_map_first_page (image_header = single lwbuf page).