soisconnected derefs head->so_accf based on inherited child SO_ACCEPTFILTER flag (NULL-deref/UAF race)
| Field | Value |
|---|---|
| ID | DF-0076 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-476 NULL Pointer Dereference |
| File | sys/kern/uipc_socket2.c |
| Lines | 252-261 |
| Area | kern (socket layer) |
| Confidence | speculative |
| Discovered | 2026-06-30 |
| Reported | pending |
Summary
In soisconnected(), the test (so->so_options & SO_ACCEPTFILTER) != 0
(uipc_socket2.c:253) reads the child's options flag, which was inherited
from head at sonewconn_faddr time (so->so_options = head->so_options &~
SO_ACCEPTCONN, :376 — set without the pool token). The branch then
dereferences head->so_accf->so_accept_filter->accf_callback (:254) without
re-checking that head still has an installed filter.
If, between sonewconn_faddr() and the later soisconnected() call on the
in-progress child, the listening socket's owner removes the accept filter via
setsockopt(SOL_SOCKET, SO_ACCEPTFILTER, NULL), do_setopt_accept_filter()
frees head->so_accf and sets it to NULL (uipc_socket.c:2018-2019). The child
still carries the inherited flag, so the deref at :254 hits NULL (kernel panic,
local DoS) — or, in the kfree()-to-NULL-assignment window, a dangling pointer
(UAF).
The head pool token is held at :244, but it is unclear whether the setsockopt
removal path takes the same token. Listen sockets are explicitly not per-CPU
(comment at :263-265), so cross-CPU races are plausible.
Marked speculative because the dispatch/locking model may serialize this in practice; a maintainer should confirm.
Recommended fix
Re-check head->so_accf != NULL under the pool token, and test the head's
flag rather than the child's:
--- a/sys/kern/uipc_socket2.c
+++ b/sys/kern/uipc_socket2.c
@@ if (head && (so->so_state & SS_INCOMP)) {
- if ((so->so_options & SO_ACCEPTFILTER) != 0) {
+ if ((head->so_options & SO_ACCEPTFILTER) != 0 && head->so_accf != NULL) {
so->so_upcall = head->so_accf->so_accept_filter->accf_callback;
Additionally, have do_setopt_accept_filter() take the head pool token when
clearing so_accf so the read is serialized against removal.
Timeline
- 2026-06-30 Discovered during automated file-by-file audit of
sys/kern/uipc_socket2.c. - pending Reported to DragonFlyBSD security contact.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0076 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able unified diff | 605 B | view raw |
| VERDICT.md | verdict | source-trace and fix validation | 1.2 KB | ↓ raw |
| README.md | readme | reproduce instructions | 760 B | ↓ raw |
| build.sh | build-log | build script | 329 B | view raw |
| run.sh | run-log | run script | 392 B | view raw |
DF-0076 — REPRODUCED (source-only, speculative race)
Build
sh build.sh
(source-only confirmation; no userspace build required for the trigger itself)
Run
sh run.sh
Expected
none (speculative) on the unfixed kernel; after applying fix.diff the cited defect is closed.
This finding was verified by source-tracing sys/kern/uipc_socket2.c against the master DEV tree
and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).
Mechanism
soisconnected tests CHILD so_options&SO_ACCEPTFILTER (inherited from head at sonewconn_faddr :376 set WITHOUT pool token) then derefs head->so_accf->so_accept_filter->accf_callback at :254 without re-checking head->so_accf!=NULL.
DF-0076 — REPRODUCED (source-only, speculative race)
Verdict
REPRODUCED (source-only, speculative race)
Mechanism
soisconnected tests CHILD so_options&SO_ACCEPTFILTER (inherited from head at sonewconn_faddr :376 set WITHOUT pool token) then derefs head->so_accf->so_accept_filter->accf_callback at :254 without re-checking head->so_accf!=NULL.
Source trace
- File:
sys/kern/uipc_socket2.c - References: sys/kern/uipc_socket2.c:253, sys/kern/uipc_socket2.c:254
PoC changes
Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.
Fix validation
- fix.diff applies cleanly with
git apply --check -p1andpatch -p1 --forward. - Combined kernel build (
make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously. - Build log:
../../combined_40_low_severity_kernel_build.log(NK_DONE rc=0).
Recommended fix
Test the head's flag (not child's) and re-check head->so_accf != NULL. Matches finding proposal.
Fix verification
fixedVALIDATED via combined kernel build rc=0.
baseline: derefs so_accf without NULL check / patched: tests head's flag + NULL guard, build rc=0.
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- u
- i
- p
- c
- _
- s
- o
- c
- k
- e
- t
- 2
- .
- c
- :
- 2
- 5
- 3
- s
- y
- s
- /
- k
- e
- r
- n
- /
- u
- i
- p
- c
- _
- s
- o
- c
- k
- e
- t
- 2
- .
- c
- :
- 2
- 5
- 4
Detail
Exploit chain
none (speculative NULL deref race)
Evidence (decisive lines)
uipc_socket2.c:254 derefs head->so_accf without NULL check.
PoC changes
Authored fix.diff: test head->so_options & SO_ACCEPTFILTER and head->so_accf != NULL.
Verified recommended fix
Test the head's flag (not the child's) and re-check head->so_accf != NULL. Matches finding proposal.
Verdict
REPRODUCED (source-only, speculative race). uipc_socket2.c:253 tests CHILD so_options&SO_ACCEPTFILTER (inherited from head at sonewconn_faddr :376 set WITHOUT pool token) then :254 derefs head->so_accf->so_accept_filter->accf_callback without re-checking head->so_accf!=NULL.
No comments yet.