Summary

uether_ifdetach calls device_delete_child(ue->ue_miibus) — which frees the miibus device_t via kobj_delete (subr_bus.c:1306) — BEFORE calling ether_ifdetach(ifp) which removes the interface from the global ifnet list. During that window, an unprivileged SIOCGIFMEDIA ioctl (dispatched without privilege check at if.c:2364) reaches uether_ioctl, reads the now-dangling ue->ue_miibus pointer (never nulled), and dereferences freed memory via device_get_softc then ifmedia_ioctl on the freed mii_data.

Root cause

In uether_ifdetach (usb_ethernet.c:289-294), the ordering is:

1. device_delete_child(ue->ue_dev, ue->ue_miibus) which calls device_detach → kobj_delete on the miibus device_t, freeing it;
2. ether_ifdetach(ifp) which calls if_detach to remove ifp from the global interface list.

The pointer ue->ue_miibus is never set to NULL after deletion.

In uether_ioctl (usb_ethernet.c:505-509), the SIOCGIFMEDIA / SIOCSIFMEDIA case reads ue->ue_miibus without holding UE_LOCK:

if (ue->ue_miibus != NULL) {
    mii = device_get_softc(ue->ue_miibus);
    error = ifmedia_ioctl(ifp, ifr, &mii->mii_media, command);
}

device_get_softc (subr_bus.c:1784) dereferences dev->softc on the freed device_t — a UAF read — and the returned mii_data pointer is also freed, so ifmedia_ioctl dereferences freed mii_data.

The ioctl dispatcher in if.c:2364-2373 dispatches SIOCGIFMEDIA with NO caps_priv_check, so any local user can trigger the read path. The race window spans the entire duration of device_delete_child (miibus teardown + kobj_delete), which is wider than a single instruction gap because the miibus detach routine and method dispatch take time.

Threat model & preconditions

• Attacker position: A local unprivileged user on a system with a USB Ethernet adapter. Issues SIOCGIFMEDIA (e.g. ifconfig ue0 media) in a tight loop.
• Privileges gained or impact:
• Primary: kernel panic (local DoS / A:H). The freed memory (M_BUS / kobj zone) could be reclaimed and groomed; device_get_softc returns an attacker-influenced softc pointer, and ifmedia_ioctl reads / writes fields in it, potentially enabling controlled kernel memory read (C:L) or, with sophisticated heap grooming of the kobj-freed slab, code execution.
• Required config or capabilities: Default kernel with any u4b Ethernet driver. The detach trigger requires physical USB access or root privilege (usbconfig unconfigure / kldunload), which limits practical exploitability to DoS on multi-user systems with physically accessible USB ports.
• Reachability: Concurrent SIOCGIFMEDIA ioctl loop (unprivileged) + USB adapter detach (physical unplug or root-driven).

Proof of concept

On a DragonFlyBSD system with a u4b Ethernet adapter (e.g. if_aue) attached as ue0:

1. Compile a tight-loop C program that opens an AF_INET datagram socket and calls ioctl(s, SIOCGIFMEDIA, &ifr) targeting ue0 in an infinite loop with no delay — this is unprivileged (SIOCGIFMEDIA has no caps_priv_check).
2. Concurrently, physically unplug the USB Ethernet adapter (or, as root, run usbconfig -u <bus> -a <addr> unconfigure or kldunload if_aue).
3. With high probability within a few hundred unplug attempts, the ioctl thread dereferences the freed miibus device_t during the window between device_delete_child (usb_ethernet.c:290) and ether_ifdetach (usb_ethernet.c:294), causing a kernel panic (NULL deref in device_get_softc on reclaimed memory, or page fault on freed / unmapped kobj slab).

Build & run

cc -o race_poc race_poc.c
./race_poc ue0 &     # unprivileged user, tight ioctl loop
# then physically unplug the USB adapter (or sudo usbconfig unconfigure)

Expected output

Kernel panic / system crash. The panic signature will be a page fault in device_get_softc or ifmedia_ioctl called from uether_ioctl.

For the info-leak variant, capture the ifmr.ifm_active / ifm_current values returned across many attempts and look for non-deterministic values indicating reads from reclaimed kernel memory.

Impact

Local DoS (kernel panic) via UAF race between USB Ethernet adapter detach and unprivileged SIOCGIFMEDIA ioctl loop. Potential info leak of freed kobj slab contents with heap grooming. The detach trigger requires physical USB access or root, keeping practical exploitability to DoS. Low severity per "narrow trigger" + "local DoS on concurrent detach".

Recommended fix

Reorder uether_ifdetach to call ether_ifdetach(ifp) BEFORE device_delete_child(ue->ue_miibus), so the ifp is removed from the global interface list (preventing all new ioctls) before the miibus is freed. Additionally null ue->ue_miibus as defense-in-depth. ether_ifdetach → if_detach does not require the miibus to be alive (it only calls if_down, ng_ether_detach, bpfdetach, if_detach — none access miibus), so the reorder is safe.

--- a/sys/bus/u4b/net/usb_ethernet.c
+++ b/sys/bus/u4b/net/usb_ethernet.c
@@ -285,16 +285,18 @@ uether_ifdetach(struct usb_ether *ue)
        /* drain any callouts */
        usb_callout_drain(&ue->ue_watchdog);

-       /* detach miibus */
-       if (ue->ue_miibus != NULL) {
-           device_delete_child(ue->ue_dev, ue->ue_miibus);
-       }
-
        /* detach ethernet */
        ether_ifdetach(ifp);

+       /* detach miibus — must come AFTER ether_ifdetach so that no
+        * concurrent SIOCGIFMEDIA ioctl can dereference the freed
+        * miibus device_t via ue->ue_miibus (SIOCGIFMEDIA requires
+        * no privilege in the generic ifioctl dispatcher). */
+       if (ue->ue_miibus != NULL) {
+           device_delete_child(ue->ue_dev, ue->ue_miibus);
+           ue->ue_miibus = NULL;
+       }
+
        /* free sysctl */
        sysctl_ctx_free(&ue->ue_sysctl_ctx);

References

• sys/bus/u4b/net/usb_ethernet.c:289-294 — detach ordering (miibus freed before ifp removed)
• sys/bus/u4b/net/usb_ethernet.c:505-509 — SIOCGIFMEDIA deref of freed ue->ue_miibus
• sys/kern/subr_bus.c:1306 — kobj_delete frees the device_t during device_delete_child
• sys/kern/subr_bus.c:1784 — device_get_softc derefs dev->softc on freed device_t
• sys/net/if.c:2364 — SIOCGIFMEDIA dispatch has no caps_priv_check
• CWE-416 Use After Free

Timeline

• 2026-07-14 Discovered during automated audit.