DF-2718 — PT_INTERP string never NUL-terminated → kernel heap OOB read + disclosure via uprintf

• File: sys/kern/imgact_elf.c
• Severity: Medium (kernel info leak, unprivileged local)
• Confidence: certain — reproduced on the guest
• Class: kernleak / CWE-125 (OOB read) + CWE-200 (info disclosure)

Root cause

exec_elfN(imgact) allocates the interpreter-path buffer with the exact PT_INTERP p_filesz and never requires NUL-termination:

• sys/kern/imgact_elf.c:663-673 — only checks p_filesz == 0 || > PAGE_SIZE || > MAXPATHLEN, then interp = kmalloc(phdr[i].p_filesz, M_TEMP, M_WAITOK) (no +1, no M_ZERO)
• sys/kern/imgact_elf.c:1817-1863 (extract_interpreter) — bcopys exactly pathsz bytes and returns success; never checks data[pathsz-1] == '\0'

The unterminated buffer is then consumed as a C string:

• sys/kern/imgact_elf.c:584 — strcmp(interp, bi->interp_path)
• sys/kern/imgact_elf.c:440 (via __elfN(load_file) :840) — nlookup_init(nd, file, UIO_SYSSPACE, ...) → copystr() reads past the allocation (bounded by MAXPATHLEN, contents discarded)
• sys/kern/imgact_elf.c:844 — uprintf("ELF interpreter %s not found\n", interp) — %s formats the buffer until the first NUL past the allocation, writing adjacent kernel-heap contents to the executing user's controlling terminal.

Reproduce

python3 make_poc.py && python3 make_poc2.py
# push seed1024 leak1000 poc_unterm to the guest, chmod +x
sh run2.sh          # seed/leak pairs, as unprivileged user, under script(1)

Expected (observed 18/20 iterations):

ELF interpreter AAAA…(1000 A's)BBBBBBBBBBBBBBBBBBBBBBBB(24) not found

The 24 B bytes are residue of the previously freed 1024-class M_TEMP allocation seeded by the prior exec — i.e. kernel heap contents from a different, freed allocation, disclosed to an unprivileged user. One iteration additionally leaked genuine kernel path-string residue:

ELF interpreter AAAA…(1000)BBBB…(24)xx/.ssh/autho/home/maxx not found

poc_unterm (single run, 1024 A's) shows the raw OOB walk stopping at the first zero byte past the slab slot.

Fix

FreeBSD added the missing check in extract_interpreter (if (data[pathsz - 1] != '\0') return (result_failure);). See fix.diff.

DF-2718 VERDICT

Status: reproduced — impact: leak — confidence: certain.

What was run

Guest: DragonFly 6.5-DEVELOPMENT #0 (INVARIANTS X86_64_GENERIC), uid 1001 (maxx).

1. make_poc.py → poc_unterm: ELF64, PT_INTERP p_filesz=1024, file bytes all 'A' with no NUL. Exec'd under script(1) so the process has a controlling terminal (uprintf output reaches us).
2. make_poc2.py → seed1024 (interp = 1024 'B', unterminated) and leak1000 (interp = 1000 'A', unterminated). The seed exec occupies a 1024-size-class kmalloc(M_TEMP) slot and frees it (imgact_elf.c:845); the leak exec's kmalloc(1000) reuses the same 1024-class slot, so bytes 1000..1023 are the freed allocation's residue.

Observed

• run.log: ELF interpreter A×1024 not found — uprintf walked one byte past the kmalloc'd buffer (stopped at a zero byte in a fresh slab page).
• run2.log (20 seed/leak pairs): 18/20 iterations printed A×1000 + B×24 — the 24 B's are kernel-heap bytes from a different, freed M_TEMP allocation (imgact_elf.c:844 %s, imgact_elf.c:668 allocation).
• iteration 15 additionally leaked real kernel path-string residue: …BBBBBBBxx/.ssh/autho/home/maxx not found — genuine kernel heap data (nlookup/namei path residue in the same size class), not attacker-supplied.

Impact

Unprivileged local kernel-heap information disclosure. Length of the disclosure is unbounded until the first NUL byte; contents are whatever follows in the M_TEMP size class (paths, and potentially pointers/binary data — iteration 15 shows binary non-ASCII bytes too). Also an unbounded %s walk in kernel address space (imgact_elf.c:844) — in principle able to walk into unmapped KVA; not observed across 40+ runs on this guest.

No uid=0 chain: leak-only primitive (contents are not attacker-steerable beyond grooming residue).

Fix validation

fix.diff adds the NUL-termination check in extract_interpreter (mirrors FreeBSD). Patched kernel build + rerun: leak gone (see fix_build.log / fix_run.log in this pack if present), baseline re-verified before patching.