Summary

vke_rx_thread() declares fd_set fdset; on the cothread stack (line 631) and uses FD_SET(sc->sc_fd, &fdset) / select(sc->sc_fd + 1, &fdset, ...) at lines 686-687. fd_set is sized for FD_SETSIZE=1024 descriptors. If sc->sc_fd >= 1024, the FD_SET macro writes fdset.__fds_bits[sc_fd / __NFDBITS] past the end of the 16-element (128-byte) fd_set, corrupting adjacent stack (return address, frame pointer, saved registers of the cothread).

Root cause

vke_rx_thread at if_vke.c:631:

fd_set fdset;

Line 686:

FD_SET(sc->sc_fd, &fdset);

— the FD_SET macro is (__fdsetp)->__fds_bits[(fd) / __NFDBITS] |= ... with the array dimensioned to FD_SETSIZE/__NFDBITS = 1024/64 = 16.

sc->sc_fd is an int (line 93) assigned once in vke_attach from info->tap_fd (line 826), which is the fd returned by netif_open_tap() in init.c:1325. There is no bounds check anywhere in the path.

If the fd exceeds 1023, the array index fd / 64 is >= 16 and the bit-or write lands past the end of the on-stack fdset. Line 687's select() call would then also read garbage from the overflowed region.

Threat model

Attacker position: requires control of the vkernel process fd layout at boot, which in practice means the operator who launches the vkernel (high PR). Triggering requires sc_fd >= 1024 — reached if the parent environment has > 1024 fds already open (e.g. a wrapper script that does ulimit -n 4096; exec 1020<&0-; ...; vkernel64 ...) or if many fds are opened between vkernel start and the SYSINIT vke_attach call.

Once reachable, the cothread stack is corrupted every RX cycle when the TAP returns EAGAIN (the normal idle case): the bit-or write clobbers saved RBP/return address, giving the cothread — which is a pthread in the vkernel userland process — control-flow hijack on the next function return.

Impact is full compromise of the vkernel process (which maps to the privilege of the host user running it).

Confidence speculative because the default boot path yields small fds (<32) and an unprivileged guest user cannot influence the fd layout.

PoC

Setup on the host (operator-grade PoC to demonstrate the corruption, since a guest user cannot influence boot fds):

1. ulimit -n 4096.
2. Open 1023 file descriptors before exec'ing the vkernel:

python python3 -c ' import os [os.open("/dev/null", os.O_RDONLY) for _ in range(1023)] os.execvp("vkernel64", ["vkernel64", "-I", "vke0:/dev/tap1", ...]) '

Now netif_open_tap's open() returns fd >= 1024.

3. Boot the vkernel; vke_attach stores this fd in sc->sc_fd.
4. Once the interface is brought up, vke_rx_thread enters its loop; the first idle read() returns -EAGAIN, taking the else branch at line
5. FD_SET(sc_fd>=1024, &fdset) writes past the stack buffer.
6. The cothread either crashes with SIGSEGV on the corrupted return address (observable in the host kernel log for the vkernel process) or, with a controlled stack layout, diverts control.

Success criterion: vkernel process crashes with a corrupted stack pointer in vke_rx_thread, or deterministic RIP control is observed under gdb attached to the vkernel.

Recommended fix

Replace the legacy select()/FD_SET pair with poll(), which has no fixed-size bitset and accepts arbitrary fd values.

--- a/sys/dev/virtual/vkernel/net/if_vke.c
+++ b/sys/dev/virtual/vkernel/net/if_vke.c
@@ -627,9 +627,9 @@ static void
 vke_rx_thread(cothread_t cotd)
 {
    struct mbuf *m;
    struct vke_softc *sc = cotd->arg;
    struct ifnet *ifp = &sc->arpcom.ac_if;
    fifo_t fifo = sc->sc_rxfifo;
-   fd_set fdset;
-   struct timeval tv;
+   struct pollfd pfd;
    int count;
    int n;
    int r;
@@ -637,11 +637,10 @@ vke_rx_thread(cothread_t cotd)
    /* Select timeout cannot be infinite since we need to check for
     * the exit flag sc->cotd_rx_exit.
     */
-   tv.tv_sec = 0;
-   tv.tv_usec = 500000;
+   pfd.fd = sc->sc_fd;
+   pfd.events = POLLIN;

-   FD_ZERO(&fdset);
    count = 0;

    while (sc->cotd_rx_exit == VKE_COTD_RUN) {
@@ -683,10 +682,8 @@ vke_rx_thread(cothread_t cotd)
                cothread_intr(cotd);
                count = 0;
            }
-           FD_SET(sc->sc_fd, &fdset);
-           r = select(sc->sc_fd + 1, &fdset, NULL, NULL, &tv);
+           r = poll(&pfd, 1, 500);
            if (r == -1) {
                fprintf(stderr,
                    VKE_DEVNAME "%d: select failed for "

(Also add #include <poll.h> at the top of the file.)

This eliminates the FD_SETSIZE ceiling entirely.