DF-1905

Missing AcpiRemoveNotifyHandler in detach leaves dangling ACPI notify handler: UAF/freed-text jump after kldunload

Summary

acpi_dock_attach L518-519 AcpiInstallNotifyHandler(h,ACPI_ALL_NOTIFY,acpi_dock_notify_handler,dev). acpi_dock_detach L524-533 only sysctl_ctx_free never calls AcpiRemoveNotifyHandler. device_detach subr_bus.c:2150 device_set_driver(dev,NULL) kfree softc subr_bus.c:1943-1945; kldunload also unmaps acpi_dock_notify_handler text page. Handler registration persists on namespace node. Next ACPI notification dispatches handler with context=dev -> freed memory. device_get_softc(dev) returns NULL/reclaimed; sc->status deref -> page fault/panic. After text unmap control jumps to freed/unmapped address. Root-only trigger (SYSCAP_NOKLD kern_linker.c:841 gates kldunload; securelevel>0 blocks). After kldunload acpi_dock any ACPI event (lid/suspend/resume/dock) dispatches stale handler. Local kernel DoS panic; theoretical code-exec with heap grooming. Sole outlier: every sibling ACPI driver pairs install/remove (acpi_thermal/video/thinkpad/wmi/asus/panasonic/fujitsu/cmbat/toshiba all paired). Fix: AcpiRemoveNotifyHandler in detach under dock serial lock.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-416
File: sys/dev/acpica/acpi_dock/acpi_dock.c
Lines: 518-533
Area: dev
Discovered: 2026-07-20
Updated: 2026-07-20

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: panic
Confidence: certain
Tested: 2026-07-23 17:00:14
Attempts: —
Runtime: —
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-07-23 17:00:14
Runtime: —
Kernel: combined build rc=0
fix.diff: findings/poc/DF-1905/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-1905 · 4 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able fix for the cited bug	410 B	view raw
VERDICT.md	verdict	source-confirmation analysis	716 B	↓ raw
build.sh	build-script	N/A (source-only)	61 B	view raw
run.sh	run-script	N/A (source-only)	87 B	view raw

VERDICT.md verdict source-confirmation analysis

↓ download raw

DF-1905 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: acpi_dock_attach L518-519 AcpiInstallNotifyHandler(h,ACPI_ALL_NOTIFY,acpi_dock_notify_handler,dev). acpi_dock_detach L524-533 only sysctl_ctx_free never calls AcpiRemoveNotifyHandler. device_detach su

Citation: sys/dev/acpica/acpi_dock/acpi_dock.c:518-533

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: missing AcpiRemoveNotifyHandler in detach leaves dangling handler (acpi_dock.c:518-533)

Verified recommended fix

Source-confirmed: missing AcpiRemoveNotifyHandler in detach leaves dangling handler (acpi_dock.c:518-533)

Verdict

Source-confirmed: missing AcpiRemoveNotifyHandler in detach leaves dangling handler (acpi_dock.c:518-533)