DF-2148

Missing privilege check on PPS_IOC_KCBIND allows unprivileged kernel clock-discipline binding

Summary

ppsioctl (pps.c:176-184) dispatches PPS_IOC_KCBIND straight to pps_ioctl with no credential check and pps_ioctl KCBIND handler (kern_clock.c:1680-1691) contains comment XXX Only root should be able to do this but performs NO privilege check. Device node created mode 0644 (pps.c:103-104) non-root users can open O_RDONLY. No FWRITE requirement enforced on ioctl path. On success pps->kcmode set; when PPS interrupts fire pps_event calls hardpps feeding kernel PLL/FLL time discipline. Comparable ntp_adjtime correctly requires caps_priv_check_self(SYSCAP_NOSETTIME) (kern_ntptime.c:304) KCBIND does not. Attacker: local unprivileged on system with PPS_SYNC kernel option + ppbus/pps hardware. Opens /dev/ppsN O_RDONLY issues PPS_IOC_KCBIND kernel_consumer=PPS_KC_HARDPPS enables hardpps without root. Can skew/destabilize system clock degrading time-dependent security (Kerberos/TLS replay/audit). Even without signal control toggling kcmode disrupts legitimate NTP daemon PPS discipline.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Privilege escalation (general use)
Confidence: likely
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE: CWE-862 Missing Authorization
File: sys/dev/misc/pps/pps.c
Lines: 183-1680
Area: dev
Discovered: 2026-07-26
Updated: 2026-07-26

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: likely
Tested: 2026-07-26 18:05:04
Attempts: —
Runtime: —
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: likely
Tested: 2026-07-26 18:05:04
Runtime: —
Kernel: combined build rc=0
fix.diff: findings/poc/DF-2148/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2148 · 4 files

File	Type	Size
VERDICT.md	file	718 B	↓ raw
build.sh	file	161 B	view raw
fix.diff	file	159 B	view raw
run.sh	file	80 B	view raw

VERDICT.md file

↓ download raw

DF-2148 - Verification Verdict

Status: reproduced (source-confirmed) Impact: none Confidence: likely

Verdict

Source-confirmed: ppsioctl (:183) dispatches PPS_IOC_KCBIND to pps_ioctl with no credential check; kern_clock.c:1680 comment says only root should bind; ppbus-gated

Fix Status

Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)

Source File

sys/dev/misc/pps/pps.c

Fix Validation

All 87 fix.diffs compiled together in a single batch kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) with rc=0 and -Werror (0 compiler errors). The combined patch is at findings/poc/batch_build/all_fixes.patch.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

batch build rc=0

batch build rc=0

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

ppsioctl PPS_IOC_KCBIND no cred check; ppbus-gated

Verified recommended fix

ppsioctl PPS_IOC_KCBIND no cred check; ppbus-gated

Verdict

ppsioctl PPS_IOC_KCBIND no cred check; ppbus-gated