Uninitialized kernel-stack info leak via fanid sysctl on MMIO/T2 backend
Summary
apple_smc_mb_sysctl_fanid() declares uint8_t buf[16] and asks apple_smc_fan_getstring() to read 16 bytes for F%dID key whose real payload is 8 bytes. On MMIO/T2 backend apple_smc_mmio_key_read() only fills min(reported_len requested_len) bytes leaving tail uninitialized. Port-IO backend always fills exactly len bytes so backends have incompatible fill contracts. desc=buf+4 handed to sysctl_handle_string() which strlen()s with no length bound. If 4-byte fan-name field not NUL-terminated strlen scans into uninitialized buf[8..15] and past buf[15] into adjacent kernel stack frame until NUL all bytes copied to userspace. Any unprivileged local user via sysctl dev.apple_smc.<unit>.fan.<n>.id. Precondition: MMIO/T2 backend active AND fan name field not NUL-terminated within 4 bytes. [VERIFIED pass2: reproduced - unpriv nobody fanid sysctl gets 4-12 bytes of never-written kernel stack incl. 0xfffff801 pointer fragment via MMIO backend partial fill; memset+bound fix-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2403 · 12 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 392 B | ↓ raw | |
| VERDICT.md | — | 1.5 KB | ↓ raw | |
| build.sh | — | 139 B | view raw | |
| dfhw.c | — | 29.3 KB | view raw | |
| env.txt | — | 254 B | view raw | |
| fix.diff | — | 365 B | view raw | |
| manifest.json | — | 893 B | view raw | |
| run.log | — | 1.2 KB | view raw | |
| run.sh | — | 147 B | view raw | |
| smcleak.c | — | 858 B | view raw | |
| smcvar.c | — | 827 B | view raw | |
| verdict.json | — | 2.2 KB | view raw |
DF-2403 -- evidence pack
Verdict: reproduced (reproduced=1, impact=leak, confidence=certain)
Build: see build.sh (dfhw.ko kld rig: verbatim apple_smc.ko symbols + fabricated softc/bus)
Run: sysctl dev.dfsm.0.spray; sysctl dev.dfsm.0.fanid (as user nobody)
See VERDICT.md for the full narrative, run.log/panic.txt for the decisive output, fix.diff for the post-verification fix.
DF-2403 VERDICT
Status: reproduced Impact: leak Confidence: certain
Uninitialized kernel-stack disclosure via the production apple_smc_mb_sysctl_fanid handler, read as unprivileged user nobody through a fabricated MMIO/T2 backend reporting the documented 8-byte F0ID payload. sysctl returned the 4-byte fan name plus 12 bytes of never-written kernel stack (including a 0xfffff801xxxxxxxx kernel-pointer fragment), terminated only by a lucky NUL; with an unlucky stack the same strlen walk runs off the kstack top into a fatal kernel-mode fault (observed once accidentally).
Kernel references
sys/dev/apple/smc/smc_sysctl.c:51sys/dev/apple/smc/smc_sysctl.c:56sys/dev/apple/smc/smc_sysctl.c:61sys/dev/apple/smc/smc_io.c:436sys/dev/apple/smc/smc_mmio.c:74
Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Notes
MMIO backend precondition confirmed: smc_mmio.c:74 fills min(reported=8, requested=16); port-IO backend fills all 16 (no leak). Leak ceiling: everything from buf[8] to the next NUL on the kstack; observed 4..12 bytes incl. kernel pointers.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
run.log (9-byte and 17-byte leak samples, deterministic across runs and preceding syscalls); smcleak.c (unprivileged trigger); the accidental fatal-walk console trace in run.log
PoC changes
fabricated MMIO register file + fabricated apple_smc_softc behind a rig nexus device; the production handler is wired as a real world-readable sysctl (dev.dfsm.0.fanid) and runs end to end
Verified recommended fix
Clamp the requested read to the reported length and NUL-terminate: memset(buf,0,sizeof(buf)) before apple_smc_fan_getstring and pass a bounded string to sysctl_handle_string
Verdict
Uninitialized kernel-stack disclosure via the production apple_smc_mb_sysctl_fanid handler, read as unprivileged user nobody through a fabricated MMIO/T2 backend reporting the documented 8-byte F0ID payload. sysctl returned the 4-byte fan name plus 12 bytes of never-written kernel stack (including a 0xfffff801xxxxxxxx kernel-pointer fragment), terminated only by a lucky NUL; with an unlucky stack the same strlen walk runs off the kstack top into a fatal kernel-mode fault (observed once accidentally).
No comments yet.