sysctl_rman leaks 4 bytes uninitialized kernel stack via struct u_resource trailing padding
Summary
sysctl_rman (subr_rman.c:654 struct u_resource ures on stack uninit; named fields set :702-720; amd64 layout r_flags u_int at offset 72 sizeof padded to 80 (4 trailing bytes) alignment 8; SYSCTL_OUT copies sizeof=80 incl 4 uninit stack bytes :722). hw.bus.rman CTLFLAG_RD unprivileged. 4 bytes stale kernel stack per resource entry KASLR bypass. struct u_rman (:653) no padding sizeof=64 not affected. Fix: struct u_resource ures={};.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0092 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | sysctl_rman leaks 4 bytes uninitialized kernel stack via struct u_resource trail | 276 B | view raw |
Fix verification
fixedfix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/subr_rman.c:700: sysctl_rman leaks 4 bytes uninitialized kernel stack via u_resource padding
Verified recommended fix
Source-confirmed at sys/kern/subr_rman.c:700: sysctl_rman leaks 4 bytes uninitialized kernel stack via u_resource padding
Verdict
Source-confirmed at sys/kern/subr_rman.c:700: sysctl_rman leaks 4 bytes uninitialized kernel stack via u_resource padding
No comments yet.