pmap_enter user/kernel boundary checks are advisory-only (kprintf, no enforcement)
Summary
pmap_enter at pmap.c:5074-5087 detects UVA+kernel_pmap and KVA+non-kernel_pmap but only kprintf warning, continues execution. KVA case at :5118 writes PTE into shared kernel page table via vtopte(va); pmap_inval_smp at :5243 uses pmap->pm_active (user pmap) not kernel_pmap->pm_active (all CPUs) -> stale TLB on non-target CPUs. No direct exploit (requires caller bug); defense-in-depth: should panic like pmap_allocpte KKASSERT at :2672.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0976 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 398 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/platform/pc64/x86_64/pmap.c:5074: pmap_enter user/kernel boundary checks are advisory-only (kprintf, no enforcement)
Verified recommended fix
Source-confirmed at sys/platform/pc64/x86_64/pmap.c:5074: pmap_enter user/kernel boundary checks are advisory-only (kprintf, no enforcement)
Verdict
Source-confirmed at sys/platform/pc64/x86_64/pmap.c:5074: pmap_enter user/kernel boundary checks are advisory-only (kprintf, no enforcement)
No comments yet.