DF-0080

MEMRANGE_SET ioctl bypasses securelevel (mem_ioctl never checks FWRITE flag)

Field	Value
ID	DF-0080
Status	new
Severity	Low
CVSS 3.1	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE	CWE-862 Missing Authorization
File	sys/kern/kern_memio.c
Lines	521-571
Area	kern (/dev/mem driver)
Confidence	likely
Discovered	2026-06-30
Reported	pending

Summary

mmopen enforces securelevel > 0 || kernel_mem_readonly only when /dev/mem is opened with FWRITE (kern_memio.c:155-158). At securelevel > 0 a root process may open /dev/mem with O_RDONLY (FREAD only) and the securelevel check is skipped entirely. mmioctl dispatches MEMRANGE_SET straight to mem_ioctl without checking a_fflag, and mem_ioctl (:521-571) receives the flags argument but never inspects it. mem_range_attr_set() calls mem_range_softc.mr_op->set(), which on amd64 is amd64_mrset (amd64_mem.c:528-599) — that path writes MTRR MSRs, changing physical memory caching attributes.

This bypasses the securelevel security boundary for privileged memory-attribute manipulation. FreeBSD guards this with if (!(flags & FWRITE)) return (EPERM); in the MEMRANGE_SET case; that guard is absent here.

Recommended fix

--- a/sys/kern/kern_memio.c
+++ b/sys/kern/kern_memio.c
@@ case MEMRANGE_SET:
+   if ((flags & FWRITE) == 0)
+       return (EPERM);
    md = kmalloc(sizeof(*md), M_MEMDESC, M_WAITOK);

Timeline

2026-06-30 Discovered during automated file-by-file audit of sys/kern/kern_memio.c.
pending Reported to DragonFlyBSD security contact.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Privilege escalation (general use)
Confidence: likely
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE: CWE-862 Missing Authorization
File: sys/kern/kern_memio.c
Lines: 521-571
Area: kern
Discovered: 2026-06-30
Updated: 2026-06-30

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: likely
Tested: 2026-07-22 20:25:14
Attempts: 1
Runtime: —
Code hash: f2dfe9aca39a9500
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
Build cmd: ./build.sh (source-only)
Run cmd: ./run.sh (source-only)

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: likely
Tested: 2026-07-22 20:25:14
Runtime: —
Kernel: DragonFly 6.5-DEVELOPMENT combined-build rc=0
fix.diff: findings/poc/DF-0080/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-0080 · 5 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able unified diff	568 B	view raw
VERDICT.md	verdict	source-trace and fix validation	1.3 KB	↓ raw
README.md	readme	reproduce instructions	840 B	↓ raw
build.sh	build-log	build script	329 B	view raw
run.sh	run-log	run script	392 B	view raw

README.md readme reproduce instructions

↓ download raw

DF-0080 — REPRODUCED (source-only, root-only)

Build

sh build.sh

(source-only confirmation; no userspace build required for the trigger itself)

Run

sh run.sh

Expected

none (root-only) on the unfixed kernel; after applying fix.diff the cited defect is closed. This finding was verified by source-tracing sys/kern/kern_memio.c against the master DEV tree and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).

Mechanism

mem_ioctl MEMRANGE_SET receives flags arg but never checks FWRITE. mmopen enforces securelevel>0||kernel_mem_readonly only for /dev/mem O_RDWR open at :155-158; root at securelevel>=1 opens /dev/mem O_RDONLY (check skipped), issues MEMRANGE_SET to mutate memory range attributes — bypass of the securelevel write gate.

VERDICT.md verdict source-trace and fix validation

↓ download raw

DF-0080 — REPRODUCED (source-only, root-only)

Verdict

REPRODUCED (source-only, root-only)

Mechanism

Source trace

File: sys/kern/kern_memio.c
References: sys/kern/kern_memio.c:155, sys/kern/kern_memio.c:521, sys/kern/kern_memio.c:559

PoC changes

Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.

Fix validation

fix.diff applies cleanly with git apply --check -p1 and patch -p1 --forward.
Combined kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously.
Build log: ../../combined_40_low_severity_kernel_build.log (NK_DONE rc=0).

Recommended fix

In MEMRANGE_SET, return EPERM if (flags & FWRITE) == 0. Matches finding proposal.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

VALIDATED via combined kernel build rc=0.

baseline: MEMRANGE_SET no FWRITE check / patched: EPERM without FWRITE, build rc=0.

↓ fix.diffDragonFly 6.5-DEVELOPMENT combined-build rc=0

Confirmed kernel references

Detail

Exploit chain

none (root-only securelevel bypass)

Evidence (decisive lines)

kern_memio.c:559 MEMRANGE_SET has no FWRITE check.

PoC changes

Authored fix.diff: in MEMRANGE_SET, return EPERM if (flags & FWRITE) == 0.

Verified recommended fix

Return EPERM in MEMRANGE_SET if (flags & FWRITE) == 0, mirroring the mmopen securelevel gate. Matches finding proposal.

Verdict

REPRODUCED (source-only, root-only). kern_memio.c:521-571 mem_ioctl MEMRANGE_SET receives flags arg but never checks FWRITE. mmopen at :155-158 enforces securelevel>0||kernel_mem_readonly only for /dev/mem O_RDWR open; root at securelevel>=1 opens /dev/mem O_RDONLY (check skipped) and issues MEMRANGE_SET — bypass of the securelevel write gate.