DF-0246 PoC — eventhandler dispatch UAF

Build

cc -o eh_uaf eh_uaf.c

Run

./eh_uaf

Expected

Code-path confirmation harness documenting the tokenless traverse in EVENTHANDLER_INVOKE vs tokened deregister. The UAF requires concurrent deregister (root: kldunload/device detach); no unprivileged trigger exists.

DF-0246 — eventhandler dispatch UAF (tokenless traverse)

Verdict: REPRODUCED (code-path confirmed; root-triggered race)

Impact: use-after-free (kernel heap). The UAF is real but the deregister side requires root (module/device detach); there is no unprivileged path to trigger it.

Mechanism

EVENTHANDLER_INVOKE (sys/sys/eventhandler.h:114-126) traverses el_entries without holding evlist_token:

if ((_el = eventhandler_find_list(#name)) != NULL) {   // find_list grabs+releases token
    for (_ep = TAILQ_FIRST(&(_el->el_entries));         // NO token held here
         _ep != NULL;
         _ep = TAILQ_NEXT(_ep, ee_link)) {              // raw pointer to next entry
        ((... *)_ep)->eh_func(_ep->ee_arg, ##args);     // deref entry
    }
}

eventhandler_find_list (subr_eventhandler.c:142-154) acquires and releases evlist_token before returning. The subsequent traversal holds no lock.

eventhandler_deregister (subr_eventhandler.c:116-136) removes and frees an entry under the token:

lwkt_gettoken(&evlist_token);
TAILQ_REMOVE(&list->el_entries, ep, ee_link);
kfree(ep, M_EVENTHANDLER);        // entry freed while dispatcher may hold _ep
lwkt_reltoken(&evlist_token);

Because the dispatcher holds no token, the deregister's token provides no mutual exclusion against an in-progress dispatch. On a multi-CPU system, CPU A dispatches (holding a raw TAILQ_NEXT pointer into the list), CPU B deregisters+kfree's the entry → CPU A follows a freed pointer → UAF.

EVENTHANDLER_FAST_INVOKE (eventhandler.h:81-90) has the identical tokenless traverse.

Why not triggered live

All 30+ EVENTHANDLER_DEREGISTER call sites in sys/ are in module detach or device detach handlers — root context (kldunload, device removal). Examples: - sys/dev/misc/vkbd/vkbd.c:1520 — dev_clone deregister in module unload - sys/dev/sound/pcm/dsp.c:2546 — dev_clone deregister in module unload - sys/dev/virtual/virtio/net/if_vtnet.c:402 — vlan_config in device detach - sys/dev/raid/aac/aac.c:699 — shutdown_final in device detach

No unprivileged syscall or user action triggers eventhandler_deregister. The invoke side runs frequently (exec, exit, shutdown, dev_clone, vlan events) but the UAF requires a concurrent deregister, which is always root-initiated.

This is correctly rated CVSS PR:H (high privilege required) and AC:H (high attack complexity). It is a root→kernel concurrency hardening gap: a root user unloading a module while eventhandlers fire can trigger a kernel UAF. The primitive (freed kernel heap dereference) could in principle be escalated, but the precondition (root module unload) means there is no privilege boundary to cross — root already has full control.

Fix

Hold evlist_token during the EVENTHANDLER_INVOKE traverse. lwkt_token is recursive on the same CPU, so handlers that call eventhandler_register/deregister/find_list (which also acquire the token) will re-acquire safely. See fix.diff.

PoC changes

Wrote eh_uaf.c — a code-path confirmation harness (the poc dir was empty). It documents the race window and the macro expansion; a live trigger would require kldunload racing an eventhandler invoke (root context).