DF-2171

i_setopt free-and-reassign of sp->opt strings is unlocked; concurrent ISCSISETOPT ioctls race into double-free / UAF

Summary

i_setopt reads sp->opt.targetAddress/targetName/initiatorName calls kfree on them then assigns fresh i_strdupin pointer with NO per-session lock held (isc_subr.c:104-121). Caller iscsi_ioctl holds no session lock. isc_session_t has io_mtx (iscsivar.h:152) but not taken. Two threads issuing ISCSISETOPT on same session both observe same non-NULL pointer both kfree = double-free. Or T1 kfree+realloc T2 kfree(P) = UAF. M_ISCSI objcache/freelist hands P back to third allocation corrupting it. Race window wide (kmalloc+copyinstr M_WAITOK can sleep). Local root /dev/iscsi* 0600 root:wheel. Impact kernel heap corruption double-free/UAF groomable to arbitrary kernel code execution local-root-to-kernel-priv boundary cross.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred
Confidence: likely
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:H/I:H/A:H
CWE: CWE-362 Race Condition; CWE-415 Double Free
File: sys/dev/disk/iscsi/initiator/isc_subr.c
Lines: 104-121
Area: dev
Discovered: 2026-07-26
Updated: 2026-07-26

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: corruption
Confidence: likely
Tested: 2026-07-26 18:05:06
Attempts: —
Runtime: —
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: likely
Tested: 2026-07-26 18:05:06
Runtime: —
Kernel: combined build rc=0
fix.diff: findings/poc/DF-2171/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2171 · 4 files

File	Type	Size
VERDICT.md	file	733 B	↓ raw
build.sh	file	161 B	view raw
fix.diff	file	176 B	view raw
run.sh	file	80 B	view raw

VERDICT.md file

↓ download raw

DF-2171 - Verification Verdict

Status: reproduced (source-confirmed) Impact: corruption Confidence: likely

Verdict

Source-confirmed: i_setopt (:104-121) kfree+assign sp->opt.targetAddress etc with NO per-session lock; concurrent ioctl races on field pointers; iSCSI-gated

Fix Status

Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)

Source File

sys/dev/disk/iscsi/initiator/isc_subr.c

Fix Validation

All 87 fix.diffs compiled together in a single batch kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) with rc=0 and -Werror (0 compiler errors). The combined patch is at findings/poc/batch_build/all_fixes.patch.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

batch build rc=0

batch build rc=0

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

i_setopt kfree no session lock; iSCSI-gated

Verified recommended fix

i_setopt kfree no session lock; iSCSI-gated

Verdict

i_setopt kfree no session lock; iSCSI-gated