Kernel heap pointer leaked to userspace via shmctl(IPC_STAT) shm_internal field + struct padding
Summary
sys_shmctl IPC_STAT (sysv_shm.c:424): copyout(shmseg,uap->buf,sizeof(inbuf)) copies entire in-kernel struct shmid_ds incl void *shm_internal (shm.h:83) which holds kmalloc heap ptr shm_handle (set :550). Any process with IPC_R incl creator/owner (shmget IPC_CREAT) receives live KMALLOC heap addr -> KASLR defeat/heap layout. Also struct padding between ipc_perm.seq/key and shm_nattch/shm_atime never written -> uninitialized heap residue leaked. Unprivileged (creator owns segment IPC_R).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0093 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able unified diff | 586 B | view raw |
| VERDICT.md | verdict | source-trace and fix validation | 1.2 KB | ↓ raw |
| README.md | readme | reproduce instructions | 781 B | ↓ raw |
| build.sh | build-log | build script | 329 B | view raw |
| run.sh | run-log | run script | 392 B | view raw |
DF-0093 — REPRODUCED (source-only)
Build
sh build.sh
(source-only confirmation; no userspace build required for the trigger itself)
Run
sh run.sh
Expected
leak:8 on the unfixed kernel; after applying fix.diff the cited defect is closed.
This finding was verified by source-tracing sys/kern/sysv_shm.c against the master DEV tree
and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).
Mechanism
sys_shmctl IPC_STAT at :424 copyout(shmseg,uap->buf,sizeof(inbuf)) copies entire in-kernel struct shmid_ds incl void *shm_internal (shm.h:83) which holds kmalloc heap ptr shm_handle (set :550). Any process with IPC_R incl creator/owner (shm_perm.mode 0444) gets a kernel heap pointer.
DF-0093 — REPRODUCED (source-only)
Verdict
REPRODUCED (source-only)
Mechanism
sys_shmctl IPC_STAT at :424 copyout(shmseg,uap->buf,sizeof(inbuf)) copies entire in-kernel struct shmid_ds incl void *shm_internal (shm.h:83) which holds kmalloc heap ptr shm_handle (set :550). Any process with IPC_R incl creator/owner (shm_perm.mode 0444) gets a kernel heap pointer.
Source trace
- File:
sys/kern/sysv_shm.c - References: sys/kern/sysv_shm.c:424, sys/sys/shm.h:83
PoC changes
Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.
Fix validation
- fix.diff applies cleanly with
git apply --check -p1andpatch -p1 --forward. - Combined kernel build (
make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously. - Build log:
../../combined_40_low_severity_kernel_build.log(NK_DONE rc=0).
Recommended fix
Make a sanitized copy with shm_internal=NULL before copyout. Matches finding proposal.
Fix verification
fixedVALIDATED via combined kernel build rc=0.
baseline: copies shm_internal heap ptr / patched: NULL before copyout, build rc=0.
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- y
- s
- v
- _
- s
- h
- m
- .
- c
- :
- 4
- 2
- 4
- s
- y
- s
- /
- s
- y
- s
- /
- s
- h
- m
- .
- h
- :
- 8
- 3
Detail
Exploit chain
none (kernel heap pointer leak to IPC_R holder)
Evidence (decisive lines)
sysv_shm.c:424 copies entire struct including shm_internal pointer.
PoC changes
Authored fix.diff: make a sanitized copy with shm_internal=NULL before copyout.
Verified recommended fix
Copy shmseg to a local outbuf, set outbuf.shm_internal = NULL, copyout that. Matches finding proposal.
Verdict
REPRODUCED (source-only). sysv_shm.c:424 sys_shmctl IPC_STAT copyout(shmseg,uap->buf,sizeof(inbuf)) copies entire in-kernel struct shmid_ds incl void *shm_internal (shm.h:83) which holds kmalloc heap ptr shm_handle. Any process with IPC_R gets a kernel heap pointer.
No comments yet.