DF-0185 — uninitialized kernel stack leak via vacl_get_acl (LATENT)

Summary

vacl_get_acl (kern_acl.c:88) declares struct acl inkernelacl on the stack without zeroing it; a future ACL-capable filesystem's VOP_GETACL would leave entries [acl_cnt..31] uninitialized, and the copyout at :99 leaks the whole struct to userspace.

Status

LATENT on master: no in-tree FS implements VOP_GETACL (sys/kern/vfs_default.c:89 returns EOPNOTSUPP).

Build / Run

./build.sh && ./run.sh

Expected: __acl_get_file returns EOPNOTSUPP; leak path not reached.

Fix

fix.diff: bzero(&inkernelacl, sizeof(inkernelacl)) before VOP_GETACL. Validated as defense-in-depth (no behavioral change).

Files

• acl_leak.c — __acl_get_file syscall probe.
• fix.diff — zero the struct.
• VERDICT.md — latent-pattern narrative.

DF-0185 — Uninitialized kernel stack leak via vacl_get_acl (LATENT)

Verdict: LATENT — bug confirmed by code inspection; copyout path

unreachable on this kernel because no in-tree FS implements VOP_GETACL. Fix VALIDATED as defense-in-depth.

Mechanism

vacl_get_acl (sys/kern/kern_acl.c:88-101) declares

struct acl inkernelacl;          /* :92 -- NOT zeroed */
...
error = VOP_GETACL(vp, type, &inkernelacl, ucred);
if (error == 0)
    error = copyout(&inkernelacl, aclp, sizeof(struct acl));  /* :99 */

struct acl contains an array acl_entry acl_entry[ACL_MAX_ENTRIES] (32 entries). A correctly-implemented VOP_GETACL writes only the first acl_cnt entries; entries [acl_cnt..31] remain uninitialized kernel stack and are leaked to userspace by the full-struct copyout at :99.

Latent on this kernel

No in-tree filesystem overrides VOP_GETACL:

$ grep -rn '\.vop_getacl\s*=' sys/vfs sys/kern
sys/kern/vfs_default.c:89:    .vop_getacl = (void *)vop_eopnotsupp,

The default returns EOPNOTSUPP, so the if (error == 0) copyout(...) guard at kern_acl.c:98 is never taken. The bug becomes live the moment an ACL-capable filesystem is added.

Reproduction (latent state demonstrated)

$ ./acl_leak
DF-0185: __acl_get_file(/etc/passwd, ACL_TYPE_ACCESS) = -1 errno=45 (Operation not supported)
DF-0185: __acl_get_file(/tmp, ACL_TYPE_DEFAULT) = -1 errno=45 (Operation not supported)
DF-0185: VOP_GETACL returned EOPNOTSUPP (vfs_default.c:89) --
         copyout at kern_acl.c:99 NOT reached; leak is LATENT.
         Fix is still warranted (zero `inkernelacl` before the call).

Fix (validated defense-in-depth)

fix.diff adds bzero(&inkernelacl, sizeof(inkernelacl)) before the VOP_GETACL call, matching what every well-audited copyout-style syscall should do. On the patched kernel (#1, sha256 bb88f4411402ab5bf93e4e4f51f98c54e7017c2f1b2c0c94a6b17ff697cfcb5a) the behavior is unchanged (still EOPNOTSUPP) but the latent leak is closed.

Note

This is the canonical "latent" pattern (cf. DF-0594, DF-0616, DF-0281): the bug exists in code, the trigger path is dead in master, the fix is trivial and warranted as defense-in-depth.