⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1829

isc_soc: UAF/refcount corruption via ext_free on reused pduq in send path

Summary

USE_MBUF build isc_sendPDU: md->m_ext.ext_arg=pq; ext_free atomic_fetchadd(refcnt,-1)==1 -> kfree(a->buf). mbufs queued into so_snd by sosend not freed until ACK (ms-to-seconds). Meanwhile proc_out 532-533 if(pq->ccb==NULL) pdu_free(sp->isc,pq) immediately for non-SCSI PDUs (NOP/login/text/logout via ISCSISEND). pdu_alloc memsets pq to 0 zeroing refcnt/buf. Old mbufs ext_free then: decrements NEW pduq refcnt; kfree(NEW buf) still referenced by NEW mbufs -> UAF/double-free. Window is network RTT; attacker-controlled target just dont ACK. Fix: separate ext_arg refcount holder decoupled from pduq lifetime.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1829 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 673 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.6 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1829 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/disk/iscsi/initiator/isc_soc.c:70-187. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

iscsi_initiator (loaded as module, not in GENERIC). Source: in USE_MBUF build, isc_sendPDU sets md->m_ext.ext_arg=pq and ext_free decrements pq->refcnt then kfrees buf when refcnt==1. The mbufs queued by sosend aren't freed until the peer ACKs. proc_out at isc_sm.c:532-533 calls pdu_free() immediately if pq->ccb==NULL, returning pq to the freepdu list while mbufs still reference it via ext_arg → UAF.

In proc_out, only call pdu_free when pq->refcnt==0 (no outstanding mbuf references).

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1829/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

In proc_out, only call pdu_free when pq->refcnt==0 (no outstanding mbuf references). Full git-apply-able diff in findings/poc/DF-1829/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/disk/iscsi/initiator/isc_soc.c:70-187. iscsi_initiator (module). In USE_MBUF build isc_sendPDU sets md->m_ext.ext_arg=pq; ext_free atomic_fetchadd(refcnt,-1)==1 -> kfree(a->buf). mbufs queued into so_snd not freed until ACK. Meanwhile proc_out isc_sm.c:532-533 if(pq->ccb==NULL) pdu_free(sp->isc,pq) immediately -> UAF once ext_free runs. Module gated.