DF-0113 — REPRODUCED (source-only, ptrace privileged)

Build

sh build.sh

(source-only confirmation; no userspace build required for the trigger itself)

Run

sh run.sh

Expected

none (tracer privileged) on the unfixed kernel; after applying fix.diff the cited defect is closed. This finding was verified by source-tracing sys/kern/sys_process.c against the master DEV tree and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).

Mechanism

PT_DETACH restores original parent via pfind(p->p_oppid)(:355)+proc_reparent(:357). p_oppid is a bare pid_t set at attach (:314), never revalidated. PIDs recycle. If original parent exits and PID reused by attacker, tracee reparented to wrong process.

DF-0113 — REPRODUCED (source-only, ptrace privileged)

Verdict

REPRODUCED (source-only, ptrace privileged)

Mechanism

PT_DETACH restores original parent via pfind(p->p_oppid)(:355)+proc_reparent(:357). p_oppid is a bare pid_t set at attach (:314), never revalidated. PIDs recycle. If original parent exits and PID reused by attacker, tracee reparented to wrong process.

Source trace

• File: sys/kern/sys_process.c
• References: sys/kern/sys_process.c:314, sys/kern/sys_process.c:355, sys/kern/sys_process.c:357

PoC changes

Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.

Fix validation

• fix.diff applies cleanly with git apply --check -p1 and patch -p1 --forward.
• Combined kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously.
• Build log: ../../combined_40_low_severity_kernel_build.log (NK_DONE rc=0).

Recommended fix

Defense-in-depth sanity check: skip reparent if the found proc equals current parent or self. Full fix would snapshot the original parent's struct proc at attach. Matches finding proposal.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.