DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2392

Missing zero-validation on machdep.acpi_timer_freq sysctl causes divide-by-zero kernel panic

Summary

acpi_timer_sysctl_freq accepts any u_int value written by root and forwards unchanged to cputimer_set_frequency(). Writing 0 executes (1000000LL<<32)/0 and (1000000000LL<<32)/0 in kern_cputimer.c:190-191 raising x86 #DE panicking kernel. Only check present (:316) validates CURRENT frequency not user-supplied new value so provides no protection. OID CTLTYPE_INT|CTLFLAG_RW no CTLFLAG_SECURE/ANYBODY so write requires SYSCAP_NOSYSCTL_WR (root-equivalent). Local root can panic deterministically with single privileged sysctl write. No special hardware state required beyond attached ACPI timer (default on virtually all x86_64 with ACPI).

Discussion (0)

No comments yet.