DF-0050 — PoC

msg_leak.c — unprivileged leak of kernel heap pointers (msg_first/ msg_last) + uninitialized padding via msgctl(IPC_STAT).

The bug

sys_msgctl IPC_STAT (sys/kern/sysv_msg.c:324) does copyout(msqptr, user_msqptr, sizeof(struct msqid_ds)) with no sanitization. struct msqid_ds (sys/sys/msg.h:68-84) carries struct msg *msg_first (:70) and *msg_last (:71) (live kernel heap pointers) and msg_pad1..4 (:78,:80,:82,:83) that are never zeroed (boot kmalloc at sysv_msg.c:130 without M_ZERO).

Build & run (unprivileged)

cc -o msg_leak findings/poc/DF-0050/msg_leak.c
./msg_leak

Expected output (bug present)

msg_first = 0xffff<...>
msg_last  = 0xffff<...>
-> kernel heap address disclosed to uid=1000 (KASLR/ASLR bypass)

DF-0050 — VERDICT

Verdict: REPRODUCED (info leak) — and the fix is VALIDATED.

The bug

sys_msgctl(IPC_STAT) at sys/kern/sysv_msg.c:324 does a verbatim copyout(msqptr, user_msqptr, sizeof(struct msqid_ds)). struct msqid_ds (sys/sys/msg.h:68-84) carries two kernel-internal pointers, struct msg *msg_first (:70) and *msg_last (:71), that are populated with live kernel heap addresses by msgsnd at sysv_msg.c:761-768. After a queue has any message queued, an unprivileged msgctl(IPC_STAT) returns those kernel pointers to userspace.

The boot-time msqids array is allocated without M_ZERO (sysv_msg.c:130), and msgget (:419-436) initializes everything except msg_pad1..msg_pad4 (msg.h:78,80,82,83); the pad fields are never written and may carry boot-time heap residue. (In this guest they happened to read zero, but the spec lets them leak.)

Threat model

Any local unprivileged user: msgget(IPC_PRIVATE) + msgsnd + msgctl(IPC_STAT). No privilege, no special config, default GENERIC kernel (6.5-DEVELOPMENT #0).

Reproduction evidence (unpatched #0 baseline)

Single-message queue, 3 runs (deterministic — the struct msg headers are allocated once at boot from a fixed pool, so the same slot is reused):

msg_first = 0xfffff8008e0ea980    <- live kernel heap pointer (M_MSG slab)
msg_last  = 0xfffff8008e0ea980

Two-message queue (proves BOTH ends of the list leak; addresses differ):

first = 0xfffff8008e0ea998  last = 0xfffff8008e0ea980  same=0
first = 0xfffff8008e0ea980  last = 0xfffff8008e0ea998  same=0

The 0xfffff800... upper 16 bits confirm these are in the DragonFlyBSD kernel-map range (KVA). Cross-checked with kernel symbols (msghdrs at 0xffffffff8131dc88 BSS; the leaked values index into the heap array it points at). This is a reliable KASLR / kernel-heap-ASLR bypass.

Impact

Info leak only — no memory corruption, no escalation chain possible. The primitive is a single kernel heap pointer (struct msg *) per call, plus possibly boot-time heap residue in the pad fields. Useful as an exploit enabler to convert a separate unreliable kernel memory-corruption bug into a reliable one. Rated Low (CWE-200 / CWE-909).

The fix

Sanitize the kernel-internal fields in a local copy before copyout:

struct msqid_ds msqout = *msqptr;
msqout.msg_first = NULL;
msqout.msg_last  = NULL;
msqout.msg_pad1  = 0;
msqout.msg_pad2  = 0;
msqout.msg_pad3  = 0;
bzero(msqout.msg_pad4, sizeof(msqout.msg_pad4));
eval = copyout(&msqout, user_msqptr, sizeof(msqout));

The finding markdown's ## Recommended fix proposal matches this exactly (no supersession). The standalone git apply-able diff is in fix.diff.

Fix validation (Phase 8)

Built a single-fix kernel (make -j6 nativekernel KERNCONF=X86_64_GENERIC, rc=0) from the with-src base + this one diff, installed it as /boot/kernel/kernel, rebooted, confirmed kern.version bumped to #1: Mon Jul 13 00:07:02 UTC 2026.

Before (unpatched #0): msg_first = 0xfffff8008e0ea980 After (patched #1): msg_first = 0x0

Confirmed deterministically across 3 single-msg runs AND the 2-message queue (both ends now NULL). The fix closes the leak completely. The kernel also still functions normally (msgsnd/msgctl succeed, exit 0).

PoC changes

The shipped msg_leak.c had nested /* ... /* ... */ */ block comments that broke the compiler (inner /* terminated the outer comment early, stray ' became a token). Rewrote the header comment to use parenthesized field descriptions instead of inner /* ... */ blocks, added #include <unistd.h> / <stdint.h> / <sys/types.h>, hardened the build with explicit IPC_RMID cleanup on error paths, and added pad-field dumps plus a LEAK: classifier that recognizes the 0xffff... kernel-map signature. Build: cc -o msg_leak msg_leak.c. No runtime/setup changes.

Reproduce

./build.sh && ./run.sh        # as unprivileged maxx
# buggy:  msg_first = 0xfffff800...
# fixed:  msg_first = 0x0