Harvested RDRAND output left unzeroed on the kernel stack
Summary
rdrand_rng_harvest collects RDRAND output into stack buffer randomness[RDRAND_SIZE+32] feeds to add_buffer_randomness_src but never clears buffer before returning. Raw HW RNG bytes persist on softclock callout stack until overwritten. Defense-in-depth/hygiene gap. Stand-alone impact negligible - requires separate kernel info-leak primitive to read stale softclock-stack bytes. CSPRNG pool further mixes material so raw RDRAND bytes not directly kernel RNG output. Reported as hardening opportunity consistent with kernel crypto hygiene expectations. [VERIFIED pass2: source-confirmed harvested RDRAND bytes left on stack; sibling DF-2139 verified same flow; explicit_bzero fix]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2405 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.5 KB | ↓ raw | |
| README.md | — | 237 B | ↓ raw | |
| build.sh | — | 85 B | view raw | |
| run.sh | — | 49 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 653 B | view raw | |
| verdict.json | — | 2.1 KB | view raw | |
| fix.diff | — | 292 B | view raw |
DF-2405 evidence pack
- finding: sys/dev/crypto/rdrand/rdrand.c (159-188)
- verdict: reproduced (certain) - see VERDICT.md
- source-only confirmation (no runtime PoC)
- reproduce: build.sh / run.sh
- fix.diff: present, git-apply-able
DF-2405 - Verification Verdict
Status: reproduced Impact: leak Confidence: certain
Mechanism
rdrand_rng_harvest fills uint8_t randomness[RDRAND_SIZE+32] with raw RDRAND output, feeds it to add_buffer_randomness_src, and returns with the harvest bytes still on the stack (never zeroed). Those bytes are CSPRNG seed input - disclosure of stack residue discloses entropy contributed to the pool.
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain hygiene; the sibling DF-2139 (verified) already demonstrated the same bytes being kprintf-ed under debug.rdrand>0 (debug-gated 4-byte disclosure), confirming the value flow. RDRAND present on the host CPU but stack residue is not directly observable without instrumentation, so no runtime PoC; fix is mechanical.
Threat / reachability
Latent code defect; see VERDICT.md.
Privilege escalation assessment
n/a (hardening)
Fix
explicit_bzero(randomness, sizeof(randomness)) after add_buffer_randomness_src.
Kernel references
sys/dev/crypto/rdrand/rdrand.c:163sys/dev/crypto/rdrand/rdrand.c:171sys/dev/crypto/rdrand/rdrand.c:184
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier
batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
Confirmed kernel references
Detail
Exploit chain
no escalation path (Info-tier hardening; see VERDICT.md)
Evidence (decisive lines)
VERDICT.md mechanism/verdict sections; fix.diff
PoC changes
none (source-only confirmation for this Info-tier item)
Verified recommended fix
explicit_bzero(randomness, sizeof(randomness)) after add_buffer_randomness_src.
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain hygiene; the sibling DF-2139 (verified) already demonstrated the same bytes being kprintf-ed under debug.rdrand>0 (debug-gated 4-byte disclosure), confirming the value flow. RDRAND present on the host CPU but stack residue is not directly observable without instrumentation, so no runtime PoC; fix is mechanical.
No comments yet.