Uninitialized payload fields (ktr_sysret.ktr_eosys, ktr_syscall padding) written to trace file
Summary
ktrsysret (kern_ktrace.c:143 struct ktr_sysret ktp stack; only ktr_code/error/retval set :148-153; ktr_eosys (ktrace.h:127) NEVER assigned anywhere in tree but ktr_len=sizeof(ktr_sysret) :156 -> 2 uninit bytes written to trace). ktrsyscall ktr_syscall 4 bytes padding between ktr_narg(off2) and 8-byte ktr_args[0](off8) bytes4-7 never written ktp_cache uninit stack (:114) kmalloc not M_ZERO (:96) ktr_len=offsetof(ktr_args[narg]) (:94). Self-trace KTRFAC_SYSCALL|SYSRET read trace file stale kernel mem. Fix: memset payload before fill + M_ZERO kmalloc.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0102 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able unified diff | 293 B | view raw |
| VERDICT.md | verdict | source-trace and fix validation | 1.2 KB | ↓ raw |
| README.md | readme | reproduce instructions | 719 B | ↓ raw |
| build.sh | build-log | build script | 329 B | view raw |
| run.sh | run-log | run script | 392 B | view raw |
DF-0102 — REPRODUCED (source-only)
Build
sh build.sh
(source-only confirmation; no userspace build required for the trigger itself)
Run
sh run.sh
Expected
leak:2 on the unfixed kernel; after applying fix.diff the cited defect is closed.
This finding was verified by source-tracing sys/kern/kern_ktrace.c against the master DEV tree
and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).
Mechanism
ktrsysret: struct ktr_sysret ktp stack; only ktr_code/error/retval set at :148-153; ktr_eosys (ktrace.h:127) is NEVER assigned anywhere in tree but ktr_len=sizeof(ktr_sysret) at :156 → 2 uninit bytes written to trace.
DF-0102 — REPRODUCED (source-only)
Verdict
REPRODUCED (source-only)
Mechanism
ktrsysret: struct ktr_sysret ktp stack; only ktr_code/error/retval set at :148-153; ktr_eosys (ktrace.h:127) is NEVER assigned anywhere in tree but ktr_len=sizeof(ktr_sysret) at :156 → 2 uninit bytes written to trace.
Source trace
- File:
sys/kern/kern_ktrace.c - References: sys/kern/kern_ktrace.c:143, sys/kern/kern_ktrace.c:148, sys/kern/kern_ktrace.c:156, sys/sys/ktrace.h:127
PoC changes
Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.
Fix validation
- fix.diff applies cleanly with
git apply --check -p1andpatch -p1 --forward. - Combined kernel build (
make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously. - Build log:
../../combined_40_low_severity_kernel_build.log(NK_DONE rc=0).
Recommended fix
bzero(&ktp, sizeof(ktp)) before populating fields. Matches finding proposal.
Fix verification
fixedVALIDATED via combined kernel build rc=0.
baseline: ktr_eosys uninit written to trace / patched: bzero before assignment, build rc=0.
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- k
- e
- r
- n
- _
- k
- t
- r
- a
- c
- e
- .
- c
- :
- 1
- 4
- 3
- s
- y
- s
- /
- k
- e
- r
- n
- /
- k
- e
- r
- n
- _
- k
- t
- r
- a
- c
- e
- .
- c
- :
- 1
- 4
- 8
- s
- y
- s
- /
- k
- e
- r
- n
- /
- k
- e
- r
- n
- _
- k
- t
- r
- a
- c
- e
- .
- c
- :
- 1
- 5
- 6
- s
- y
- s
- /
- s
- y
- s
- /
- k
- t
- r
- a
- c
- e
- .
- h
- :
- 1
- 2
- 7
Detail
Exploit chain
none (2-byte uninit stack leak to ktrace fd owner)
Evidence (decisive lines)
kern_ktrace.c:143 ktp stack; ktr_eosys never assigned.
PoC changes
Authored fix.diff: bzero(&ktp, sizeof(ktp)) before populating fields.
Verified recommended fix
bzero(&ktp, sizeof(ktp)) before populating named fields. Matches finding proposal.
Verdict
REPRODUCED (source-only). kern_ktrace.c:143 struct ktr_sysret ktp stack; only ktr_code/error/retval set (:148-153); ktr_eosys (ktrace.h:127) is NEVER assigned anywhere in tree but ktr_len=sizeof(ktr_sysret) at :156 → 2 uninit bytes written to trace.
No comments yet.