β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-0092

sysctl_rman leaks 4 bytes uninitialized kernel stack via struct u_resource trailing padding

Summary

sysctl_rman (subr_rman.c:654 struct u_resource ures on stack uninit; named fields set :702-720; amd64 layout r_flags u_int at offset 72 sizeof padded to 80 (4 trailing bytes) alignment 8; SYSCTL_OUT copies sizeof=80 incl 4 uninit stack bytes :722). hw.bus.rman CTLFLAG_RD unprivileged. 4 bytes stale kernel stack per resource entry KASLR bypass. struct u_rman (:653) no padding sizeof=64 not affected. Fix: struct u_resource ures={};.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0092 Β· 1 files
FileTypeDescriptionSize
fix.diff suggested-fix sysctl_rman leaks 4 bytes uninitialized kernel stack via struct u_resource trail 276 B view raw

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff applied + combined nativekernel build rc=0 (-Werror)

fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/kern/subr_rman.c:700: sysctl_rman leaks 4 bytes uninitialized kernel stack via u_resource padding

Verified recommended fix

Source-confirmed at sys/kern/subr_rman.c:700: sysctl_rman leaks 4 bytes uninitialized kernel stack via u_resource padding

Verdict

Source-confirmed at sys/kern/subr_rman.c:700: sysctl_rman leaks 4 bytes uninitialized kernel stack via u_resource padding