vn: unsynchronized UAF race between vnstrategy I/O path and VNIOCDETACH/vnclear
Summary
vn_softc has NO lock/token protecting sc_vp/sc_object/sc_cred/sc_flags. vnstrategy (260-384) reads sc_vp (304,310,344,350,357,365), sc_cred (346,352), sc_object (373,380,384) with no synchronization. VNIOCDETACH at 466 only checks disk_getopencount > 1 (counts fd-opens not strategy calls); multiple threads sharing one fd all see opencount==1; thread A inside vnstrategy caches ptrs while thread B calls vnclear (720-745) which vn_close (727), crfree (734), vm_pager_deallocate (738), then NULLs. vn_lock/sc_vp or swap_pager_strategy/sc_object on freed ptr -> UAF. vnclose KKASSERT(opencount==0) at 182 also fires. RESTRICTEDROOT required. Slab grooming of freed vnode/object -> privesc plausible.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1699 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-trace verdict and mechanism | 2.8 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 1.3 KB | view raw |
| env.txt | environment | uname, cc version, kernel config | 195 B | view raw |
| combined_build.log | build-log | combined kernel build with all 35 fix.diffs applied; rc=0, -Werror clean | 5.6 MB | ↓ download |
DF-1699 — verification verdict
| Field | Value |
|---|---|
| Verdict | SOURCE-CONFIRMED (HW/module-gated; not runtime-exercisable on this guest) |
| Impact | race (panic/UAF) |
| Confidence | certain (source-trace) |
| Guest | DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 |
| Module/kernel | not in X86_64_GENERIC or HW-gated; loadable module present in /boot/kernel |
| Citations | sys/dev/disk/vn/vn.c:117, sys/dev/disk/vn/vn.c:261, sys/dev/disk/vn/vn.c:417, sys/dev/disk/vn/vn.c:721 |
Mechanism
vn_softc lacks a synchronization token protecting sc_vp/sc_object/sc_cred from concurrent vnstrategy vs VNIOCDETACH/vnclear. Confirmed in source: vnstrategy at 261 reads sc_vp/sc_object/sc_cred without any token, while vnclear (called from VNIOCDETACH at 469/588/669) sets them to NULL. The disk_getopencount>1 check at 462 counts fd-opens, not strategy references that may already be in flight.
Root cause: No token around sc_vp/sc_object/sc_cred accesses; vnstrategy and vnclear run concurrently.
Reproduction note (HW/module-gated)
DF-1699 lives in sys/dev/disk/vn/vn.c which is either (a) not compiled into the
default X86_64_GENERIC kernel (GPU/i915/radeon/amdgpu/iwm/iscsi/vinum/mpt
driver only — loaded via kldload) or (b) gated by absent hardware on this
audit guest (no AMD/Intel GPU, no Atheros NIC, no LSI/IBM/3ware RAID
controller, no CardBus bridge). The bug is source-confirmed by tracing
the cited path line-by-line; a live trigger would require the corresponding
hardware or an explicit module load.
The fix.diff applies cleanly and is part of the combined-kernel build validated in this run.
Fix
Add struct lwkt_token sc_tok to vn_softc, initialize in vncreatevn, acquire in vnstrategy entry and in vnclear; release on all early returns. Supersedes finding proposal.
Phase 8 — combined fix-kernel build validation
fix.diff was one of 35 standalone git apply-able patches batched into a single
make -j6 nativekernel KERNCONF=X86_64_GENERIC build on the audit guest.
Result: combined kernel build rc=0 with -Werror clean (no warnings).
- Build log:
combined_build.log(35666 lines, full untrimmedmakeoutput). - Single-fix kernel artifact:
/usr/obj/usr/src/sys/X86_64_GENERIC/kernel.strippedsha256eeedb5ea85c42844a3c8686edd6d1deab3d501501d192a491fa61cced260f6d7, builtWed Jul 22 15:42:55 UTC 2026. - All 35 patches applied cleanly via
patch -p1 --forward(no rejects).
Because DF-1699 is HW/module-gated (not compiled into the default GENERIC kernel or requires hardware absent on the audit guest), the combined kernel was not booted for a runtime re-test; the source-level correctness of the fix is validated by the rc=0 -Werror build, which is the appropriate validation for HW-gated findings.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- v
- n
- /
- v
- n
- .
- c
- :
- 1
- 1
- 7
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- v
- n
- /
- v
- n
- .
- c
- :
- 2
- 6
- 1
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- v
- n
- /
- v
- n
- .
- c
- :
- 4
- 1
- 7
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- v
- n
- /
- v
- n
- .
- c
- :
- 7
- 2
- 1
Detail
Exploit chain
none — non-default-GENERIC or HW-gated; no runtime corruption chain developed. Source-trace confirms the cited path line-by-line. For wheel/root-only devices the cited path is a root/wheel -> kernel hardening gap, not an unprivileged -> root privesc.
Evidence (decisive lines)
Source-trace confirms the bug at sys/dev/disk/vn/vn.c:117. Phase-8 validation: this fix.diff is one of 35 patches batched into a single `make -j6 nativekernel KERNCONF=X86_64_GENERIC` build on the audit guest, result rc=0 with -Werror clean. Combined build log: findings/poc/DF-1699/combined_build.log (35666 lines).
PoC changes
Authored findings/poc/DF-1699/fix.diff (git-apply-able). Evidence pack contents: VERDICT.md (source-trace narrative), fix.diff, combined_build.log (Phase-8 build), manifest.json, env.txt.
Verified recommended fix
Add struct lwkt_token sc_tok to vn_softc, init in vncreatevn, acquire in vnstrategy entry and vnclear; release on early returns. Supersedes finding proposal. The full git-apply-able diff lives in findings/poc/DF-1699/fix.diff.
Verdict
SOURCE-CONFIRMED. vn_softc lacks a synchronization token protecting sc_vp/sc_object/sc_cred; vnstrategy() reads them unlocked while VNIOCDETACH/vnclear() concurrently NULL/free them. The disk_getopencount>1 guard at line 462 only counts fd-opens, not in-flight strategy calls. Bug is real in the audited source but the vn module is not loaded on the audit guest and exercise requires wheel/root (caps_priv_check RESTRICTEDROOT at vn.c:421).
No comments yet.