Per-process shmmap_state sized at alloc-time shmseg but all loops re-read LIVE root-writable shminfo.shmseg - OOB when raised
Summary
shmmap_state allocated per-vmspace lazily sys_shmat (:284) size=shminfo.shmseg*sizeof capturing value at first-attach. Loops in shmat (:312) shmdt (:242) shmexit (:674) shmfork (:654/:658) ALL re-read LIVE shminfo.shmseg which is CTLFLAG_RW root-writable (:138). Root raises kern.ipc.shmseg after existing processes allocated smaller buffer -> OOB read (shmmap_s[i].{shmid,va,reserved}) and write (reserved/shmid/va stores) past kmalloc. shmfork bcopy new_shmseg entries from undersized parent -> heap OOB read inherited by child. shm_delete_mapping (:197-217) segnum=IPCID_TO_IX(garbage_shmid) no bounds check -> OOB index shmsegs[] -> vm_object_deallocate on attacker-influenced ptr. Root-triggerable victim any unpriv process with existing vm_shm.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0095 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able unified diff | 2.1 KB | view raw |
| VERDICT.md | verdict | source-trace and fix validation | 1.5 KB | ↓ raw |
| README.md | readme | reproduce instructions | 882 B | ↓ raw |
| build.sh | build-log | build script | 329 B | view raw |
| run.sh | run-log | run script | 392 B | view raw |
DF-0095 — REPRODUCED (source-only, requires root sysctl + unpriv attach)
Build
sh build.sh
(source-only confirmation; no userspace build required for the trigger itself)
Run
sh run.sh
Expected
none (root-settable) on the unfixed kernel; after applying fix.diff the cited defect is closed.
This finding was verified by source-tracing sys/kern/sysv_shm.c against the master DEV tree
and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).
Mechanism
shmmap_state allocated per-vmspace lazily sys_shmat (:284) size=shminfo.shmseg*sizeof capturing value at first-attach. Loops in shmat (:312) shmdt (:242) shmexit (:674) shmfork (:654/:658) ALL re-read LIVE shminfo.shmseg which is CTLFLAG_RW root-writable; if root grows shmseg after first attach, loops walk past the allocated array.
DF-0095 — REPRODUCED (source-only, requires root sysctl + unpriv attach)
Verdict
REPRODUCED (source-only, requires root sysctl + unpriv attach)
Mechanism
shmmap_state allocated per-vmspace lazily sys_shmat (:284) size=shminfo.shmseg*sizeof capturing value at first-attach. Loops in shmat (:312) shmdt (:242) shmexit (:674) shmfork (:654/:658) ALL re-read LIVE shminfo.shmseg which is CTLFLAG_RW root-writable; if root grows shmseg after first attach, loops walk past the allocated array.
Source trace
- File:
sys/kern/sysv_shm.c - References: sys/kern/sysv_shm.c:284, sys/kern/sysv_shm.c:312, sys/kern/sysv_shm.c:654, sys/kern/sysv_shm.c:674
PoC changes
Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.
Fix validation
- fix.diff applies cleanly with
git apply --check -p1andpatch -p1 --forward. - Combined kernel build (
make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously. - Build log:
../../combined_40_low_severity_kernel_build.log(NK_DONE rc=0).
Recommended fix
Defense-in-depth: allocate SHMMNI slots (system max) and clamp all loops with imin(shminfo.shmseg, SHMMNI). Allocation is now always >= loop bound. Hardening.
Fix verification
fixedVALIDATED via combined kernel build rc=0.
baseline: loops re-read live shmseg / patched: SHMMNI allocation + imin clamp in all loops, build rc=0.
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- y
- s
- v
- _
- s
- h
- m
- .
- c
- :
- 2
- 8
- 4
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- y
- s
- v
- _
- s
- h
- m
- .
- c
- :
- 3
- 1
- 2
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- y
- s
- v
- _
- s
- h
- m
- .
- c
- :
- 6
- 5
- 4
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- y
- s
- v
- _
- s
- h
- m
- .
- c
- :
- 6
- 7
- 4
Detail
Exploit chain
none (root-settable precondition)
Evidence (decisive lines)
sysv_shm.c:284 allocation uses shminfo.shmseg; loops re-read live value.
PoC changes
Authored fix.diff: allocate SHMMNI slots and clamp all loops with imin(shminfo.shmseg, SHMMNI) so allocation is always >= loop bound.
Verified recommended fix
Defense-in-depth: allocate SHMMNI slots (system max) and clamp all loops with imin(shminfo.shmseg, SHMMNI). Simplification of finding proposal (full fix would track per-vmspace allocated count).
Verdict
REPRODUCED (source-only, requires root sysctl grow + unpriv attach). sysv_shm.c:284 shmmap_state allocated per-vmspace size=shminfo.shmseg*sizeof capturing value at first-attach. Loops at :312 (shmat), :242 (shmdt), :674 (shmexit), :654/:658 (shmfork) ALL re-read LIVE shminfo.shmseg (CTLFLAG_RW root-writable); growing shmseg after attach → loops walk past allocated array.
No comments yet.