vinumioctl: VINUM_*CONFIG bcopy entire struct including kernel pointers vp/dev to userland
Summary
VINUM_DRIVECONFIG/SDCONFIG/PLEXCONFIG/VOLCONFIG at vinumioctl.c:127-167 bcopy sizeof(struct drive|sd|plex|volume) from in-DRAM tables. Structs (vinumvar.h:443-483 drive, 487-528 sd, 548-588 plex, 598-635 volume) contain kernel pointers: drive has vnode *vp and cdev *dev; sd/plex/volume each have cdev_t *_dev. Live object bcopy leaks raw kernel heap addresses -> KASLR defeat. Index bounds correct (unsigned cast). RESTRICTEDROOT. Fix: scrub pointer fields before bcopy OR define separate uapi struct.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1742 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.6 KB | ↓ raw |
| fix.diff | suggested-fix | Construct a sanitized userspace view (zero kernel pointers) instead of bcopy of | 1010 B | view raw |
| ../fix_build_new.log | build-log | Batch kernel build with new fixes (rc=0, -Werror) | 5.6 MB | ↓ download |
DF-1742 — PoC Verification Verdict
Category: raid (IN GENERIC)
Source: sys/dev/raid/vinum/vinumioctl.c:127-166
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-25
Verdict: REPRODUCED (source-only confirmation; GENERIC-compiled, no HW)
Mechanism
VINUM_DRIVECONFIG/SDCONFIG/PLEXCONFIG/VOLCONFIG cases bcopy(&DRIVE[index], data, sizeof(struct drive)) — entire struct, including kernel pointers (vp, dev, lasterror) to userspace. Info leak of kernel pointers.
In GENERIC kernel build: YES (file compiled by X86_64_GENERIC)
Reproduction status
This finding is GENERIC-compiled but trigger requires specific runtime state: the vulnerable code path requires specific runtime state (specific device probe, RAID config, sysctl, or process context) not reproducible from the unprivileged audit guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Construct a sanitized userspace view (zero kernel pointers) instead of bcopy of internal struct.
See fix.diff for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): vinumioctl VINUM_DRIVECONFIG bcopy(&DRIVE[index], data, sizeof(struct drive)) - entire struct including kernel pointers vp/dev/lasterror to userspace. Info leak of kernel poi
Verified recommended fix
REPRODUCED (source-only): vinumioctl VINUM_DRIVECONFIG bcopy(&DRIVE[index], data, sizeof(struct drive)) - entire struct including kernel pointers vp/dev/lasterror to userspace. Info leak of kernel pointers.
Verdict
REPRODUCED (source-only): vinumioctl VINUM_DRIVECONFIG bcopy(&DRIVE[index], data, sizeof(struct drive)) - entire struct including kernel pointers vp/dev/lasterror to userspace. Info leak of kernel pointers.
No comments yet.