DragonFly sysctl backlight handler captures drm_connector_state before modeset lock enabling UAF
Summary
sysctl_backlight_handler at intel_panel.c:1815: conn_state=connector->base.state captured before lock. :1829 sysctl_handle_int sleeps (user copy). :1835 drm_modeset_lock then intel_panel_set_backlight(conn_state,...). Concurrent atomic modeset frees old state via drm_atomic_state_default_clear. Stale conn_state->connector deref -> UAF. CTLFLAG_ANYBODY (unprivileged). Race vs concurrent modeset. Fix: capture state under modeset lock.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1411 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Capture conn_state under drm_modeset_lock instead of before sysctl_handle_int sleep. | 864 B | view raw |
| VERDICT.md | verdict | Full source-trace analysis | 2.1 KB | ↓ raw |
| build.sh | build-script | Kernel build validation | 535 B | view raw |
| run.sh | run-script | PoC runner (not runnable on guest) | 476 B | view raw |
| fix_build.log | build-log | Full kernel build output (make nativekernel rc=0) | 5.6 MB | ↓ download |
| env.txt | environment | Guest environment | 277 B | view raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-1411 — Verification Verdict
Verdict: CONFIRMED-BY-SOURCE-TRACE (HW-gated)
Status: inconclusive (HW-gated / not reachable as unprivileged maxx) Impact: none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only) Confidence: certain (source-trace confirmed bug is real)
Mechanism
sysctl_backlight_handler (:1814): conn_state=connector->base.state captured before modeset lock. :1829 sysctl_handle_int sleeps (user copy). :1835 drm_modeset_lock then intel_panel_set_backlight(conn_state,...). Concurrent atomic modeset frees old state via drm_atomic_state_default_clear. Stale conn_state->connector deref → UAF. CTLFLAG_ANYBODY (unprivileged) — but requires i915 hardware.
Source: sys/dev/drm/i915/intel_panel.c:1814, 1829, 1835
Why it cannot be reproduced on this guest
HW-gated. i915.ko requires Intel integrated graphics. No Intel GPU in QEMU guest.
Phase 6: Escalation Assessment
This is a HW-gated GPU module (i915 backlight) finding. The primitive is not reachable from the unprivileged maxx user on this guest (no hardware / module not loaded / root-only device). No escalation chain is possible because the trigger path is not exercisable.
For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest. For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx (uid 1001) has no operator group membership.
Fix
Move conn_state capture inside the modeset lock section (after drm_modeset_lock, before intel_panel_set_backlight).
Fix description: Capture conn_state under drm_modeset_lock instead of before sysctl_handle_int sleep.
The full git-apply-able diff is in fix.diff. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via make nativekernel rc=0).
Classification
- status: inconclusive
- reproduced: 0
- impact: none
- fix_status: not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- i
- 9
- 1
- 5
- /
- i
- n
- t
- e
- l
- _
- p
- a
- n
- e
- l
- .
- c
- :
- 1
- 8
- 1
- 4
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- i
- 9
- 1
- 5
- /
- i
- n
- t
- e
- l
- _
- p
- a
- n
- e
- l
- .
- c
- :
- 1
- 8
- 2
- 9
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- i
- 9
- 1
- 5
- /
- i
- n
- t
- e
- l
- _
- p
- a
- n
- e
- l
- .
- c
- :
- 1
- 8
- 3
- 5
Detail
Exploit chain
none (UAF race — stale drm_connector_state deref after concurrent modeset frees it. Would be write-capable on real Intel iGPU with unprivileged sysctl access (CTLFLAG_ANYBODY). HW-gated on this guest.)
Evidence (decisive lines)
Source trace: intel_panel.c:1814 'const struct drm_connector_state *conn_state = connector->base.state' — captured before lock. :1829 sysctl_handle_int (sleeps). :1835 drm_modeset_lock (too late).
PoC changes
Authored fix.diff: move conn_state capture inside drm_modeset_lock section (after lock, before intel_panel_set_backlight).
Verified recommended fix
Capture conn_state under drm_modeset_lock instead of before sysctl_handle_int sleep. matches finding proposal. Full diff in findings/poc/DF-1411/fix.diff.
Verdict
CONFIRMED BY SOURCE TRACE. sysctl_backlight_handler (:1814): conn_state=connector->base.state captured before modeset lock. :1829 sysctl_handle_int sleeps. :1835 drm_modeset_lock then intel_panel_set_backlight(conn_state). Concurrent modeset frees state → stale conn_state deref → UAF. CTLFLAG_ANYBODY (unprivileged). Bug is real but HW-gated: i915.ko requires Intel iGPU.
No comments yet.