Uninitialized kernel stack leaked to unprivileged users via sysctl when ACPI get-method fails
Summary
sysctl_acpi_sony_gen_handler declares local int val without initializing ignores return status of acpi_GetInteger then hands &val to sysctl_handle_int which copies verbatim to userspace. When underlying ACPI get-method absent or fails (common for contrast/bass_gain/pcr/azp/lnp on many Sony laptops) val never written 4 bytes stale kernel stack disclosed to any unprivileged reader of sysctl. acpi_GetInteger only writes *number on ACPI_SUCCESS on AE_NOT_FOUND/AE_TYPE variable left untouched. sysctl_handle_int executes SYSCTL_OUT unconditionally. Read path requires no privilege (caps check gated on req->newptr writes only). Several registered oids refer to optional features not present on all SNY5001 implementations so method evaluation returns AE_NOT_FOUND and leak triggers deterministically. Deterministic per node repeatable trivially scripted. [VERIFIED pass2: reproduced - uid 1001 reads get brightness 7 real vs all 8 missing-getmethod nodes minus 1 stale kernel stack deterministic x3; error-return fix-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2391 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 634 B | ↓ raw | |
| VERDICT.md | — | 1.4 KB | ↓ raw | |
| env.txt | — | 145 B | view raw | |
| fix.diff | — | 707 B | view raw | |
| fixed.log | — | 279 B | view raw | |
| run.log | — | 468 B | view raw | |
| run.sh | — | 121 B | view raw | |
| verdict.json | — | 1.8 KB | view raw |
DF-2391 - sony sysctl uninitialized kernel stack leak
Rig (ACHARNESS + ssdt_acsim SNY0: only GPID/GBRT/SBRT defined)
Any unprivileged user: sysctl -n hw.acpi.sony.brightness -> 7 (real, GBRT exists) sysctl -n hw.acpi.sony.contrast -> -1 (GCTR absent) ... bass_gain pcr wdp cdp azp lnp -> -1 (all absent) The -1 is the untouched kernel-stack val from sysctl_acpi_sony_gen_handler (acpi_sony.c:183-187).
Fixed kernel (fix.diff: val=0 + propagate acpi_GetInteger failure)
sysctl hw.acpi.sony.contrast -> error return (no value) sysctl hw.acpi.sony.brightness -> 7 (unchanged)
DF-2391 VERDICT
Status: reproduced (reproduced) Impact: leak Confidence: certain Attempts: 2
Unprivileged (uid 1001) reads of every optional acpi_sony sysctl node returned the stale kernel-stack int: brightness (getmethod GBRT present) returned the real 7 while all 8 nodes whose getmethods are absent returned -1 across 3 rounds - 4 bytes of uninitialized kernel stack per read, exactly as filed (val declared uninitialized at acpi_sony.c:183, acpi_GetInteger failure ignored at :185, sysctl_handle_int SYSCTL_OUTs it verbatim). Fixed kernel: missing getmethod -> sysctl read returns an error, no value disclosed.
Kernel references
sys/dev/acpica/acpi_sony/acpi_sony.c:179sys/dev/acpica/acpi_sony/acpi_sony.c:183sys/dev/acpica/acpi_sony/acpi_sony.c:185sys/dev/acpica/acpi_sony/acpi_sony.c:187
Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS x86_64
Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
unauthenticated-to-host local unprivileged kernel stack disclosure (4 bytes per node read; repeated reads with different preceding sysctl activity vary the leaked residue)
Evidence (decisive lines)
run.log (brightness 7 vs contrast/bass_gain/pcr/wdp/cdp/azp/lnp all -1, x3 rounds, uid=1001); fixed.log (contrast read returns error; brightness still 7)
PoC changes
no PoC existed; sysctl read sweep written for this batch
Verified recommended fix
see fix.diff
Verdict
Unprivileged (uid 1001) reads of every optional acpi_sony sysctl node returned the stale kernel-stack int: brightness (getmethod GBRT present) returned the real 7 while all 8 nodes whose getmethods are absent returned -1 across 3 rounds - 4 bytes of uninitialized kernel stack per read, exactly as filed (val declared uninitialized at acpi_sony.c:183, acpi_GetInteger failure ignored at :185, sysctl_handle_int SYSCTL_OUTs it verbatim). Fixed kernel: missing getmethod -> sysctl read returns an error, no value disclosed.
No comments yet.