⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0126

TIOCCONS privilege check skipped when a_cred is NULL

Summary

TIOCCONS handler(:486-495) only runs caps_priv_check when a_cred!=NULL. If NULL, check skipped, constty cleared. Userspace ioctl always sets a_cred. Only destructive in clear-constty direction (redirect to physical console). Defense-in-depth.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0126 · 1 files
FileTypeDescriptionSize
manifest.json file 389 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/kern/tty_cons.c:486: TIOCCONS privilege check skipped when a_cred is NULL

Verified recommended fix

Source-confirmed at sys/kern/tty_cons.c:486: TIOCCONS privilege check skipped when a_cred is NULL

Verdict

Source-confirmed at sys/kern/tty_cons.c:486: TIOCCONS privilege check skipped when a_cred is NULL