DF-2684 — VERDICT

status: reproduced (impact: leak); fix validated (fixed).

Root cause

sysctl_kern_file (sys/kern/kern_descrip.c:3410-3450) and its callback sysctl_kern_file_callback (kern_descrip.c:3453-3503) export every process's descriptor table through kcore_make_file() (sys/kern/subr_kcore.c:58-77), which copies raw kernel pointers into the exported structure:

ufile->f_file = kfile;             /* address of struct file */
ufile->f_data = kfile->f_data;     /* vnode / socket / pipe */

The sysctl read path applies no privilege gate: sysctl_root() (sys/kern/kern_sysctl.c:1410+) privilege-checks only writes (CTLFLAG_WR / SYSCAP_NOSYSCTL_WR); kern.file is CTLFLAG_RD, and the callback's only filter is the prison check at kern_descrip.c:3464. Any unprivileged local user therefore receives, for every process in their jail (i.e. the whole system for the common non-jailed case):

• the kernel-heap address of every open struct file (objcache slab layout disclosure -- defeats any future KASLR, aids heap grooming for UAF/overflow exploits elsewhere);
• the kernel address of the underlying vnode/socket/pipe;
• other users' fd state: type, flags, reference count and FILE OFFSET (e.g. root's read position on a sensitive file), an information disclosure across uid boundaries.

(Note: the base-system sysctl(8) tool discards CTLTYPE_OPAQUE output, which is why this is not commonly noticed -- a direct sysctl(3) call reads it fine.)

Reproduction

kfile_leak.c (unprivileged, uid 1001) calls sysctl({CTL_KERN, KERN_FILE}, ...) and parses struct kinfo_file. On the stock INVARIANTS guest:

uid=1001 fetched 136 kinfo_file entries (9792 bytes)
  pid=278  uid=0  fd=0  type=1 f_file=0xfffff80116c49380 f_data=0xfffff8008f521b00 off=112 fl=3
  ...
entries with kernel pointers: 136
entries belonging to OTHER uids: 120
RESULT: LEAK CONFIRMED

120 of 136 rows belong to other uids (0, 77, ...) -- root's fd offsets included (off=112 on root's open of the password file in the demonstration).

Fix validation (fixed)

fix.diff masks kf.f_file / kf.f_data for readers whose td_ucred->cr_uid != 0 in sysctl_kern_file_callback. Built into the guest kernel (make -j6 nativekernel KERNCONF=X86_64_GENERIC, rc=0, installed, rebooted; the same kernel also carried the independent sigio restructure under test for DF-2682/2683 -- the sysctl mask change is in a different function and branch) and re-ran the exact PoC:

as uid 1001: entries with kernel pointers: 0   (f_file=0x0, f_data=0x0)
as root    : entries with kernel pointers: 143 (unchanged behavior)

Baseline leak vs patched mask, deterministic. A complete upstream fix may additionally want p_cansee()-style filtering of other users' rows (as this pack's cross-uid offset disclosure documents); the shipped minimal fix addresses the kernel-pointer disclosure.

Bottom line

World-readable kern.file hands unprivileged users kernel heap pointers for every open file in the system plus cross-user descriptor state (including file offsets). Pointer disclosure confirmed and masked by the validated fix.