pps_fetch_timeout() feeds user-supplied unnormalized tv_nsec into tstohz_low(), whose int truncation yields an attacker-chosen (possibly negative) sleep tick count
| Field | Value |
|---|---|
| ID | DF-2723 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-190 / CWE-20 |
| File | sys/kern/kern_clock.c |
| Lines | 1609-1618, 1668-1676 (truncation at :1272) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
PPS_IOC_FETCH passes the user's pps_fetch_args.timeout to
pps_fetch_timeout() after validating only tsformat and non-zero-ness;
tv_nsec range is never checked. pps_fetch_timeout() then calls
tstohz_low() whose documented contract requires a normalized
non-negative timespec. A negative or ≥1e9 tv_nsec makes the
(u_long)ts->tv_nsec/nstick quotient astronomically large and the
(int) cast truncates it to an arbitrary int32 "to" — including
negatives — passed to tsleep(). Bounded impact: negative values clamp
to 1 tick (callout layer documents negative to_ticks as legal) and
huge positives just produce a long ETIMEDOUT sleep; only the caller's
own ioctl wait semantics are perturbed. Reachability additionally
requires a /dev/ppsN node (driver not in GENERIC; absent from the
guest) plus parallel-port PPS hardware.
Recommended fix
--- a/sys/kern/kern_clock.c
+++ b/sys/kern/kern_clock.c
@@ -1669,6 +1669,10 @@ pps_ioctl(u_long cmd, caddr_t data, struct pps_state *pps)
if (fapi->tsformat && fapi->tsformat != PPS_TSFMT_TSPEC)
return (EINVAL);
if (fapi->timeout.tv_sec != 0 || fapi->timeout.tv_nsec != 0) {
+ if (fapi->timeout.tv_sec < 0 ||
+ fapi->timeout.tv_nsec < 0 ||
+ fapi->timeout.tv_nsec >= 1000000000)
+ return (EINVAL);
err = pps_fetch_timeout(&fapi->timeout, pps);
if (err != 0)
return (err);
Timeline
- 2026-08-30 Discovered during pass-2 audit of kern_clock.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2723 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 2.0 KB | ↓ raw | |
| README.md | — | 321 B | ↓ raw | |
| build.sh | — | 98 B | view raw | |
| run.sh | — | 106 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 759 B | view raw | |
| verdict.json | — | 2.5 KB | view raw | |
| fix.diff | — | 490 B | view raw | |
| pps_fetch_timeout.c | — | 2.3 KB | view raw | |
| run.log | — | 226 B | view raw |
DF-2723 evidence pack
- finding: sys/kern/kern_clock.c (1609-1622 (pps_fetch_timeout), 1265-1277 (tstohz_low), 1643-1676 (PPS_IOC_FETCH))
- verdict: reproduced (certain) - see VERDICT.md
- runtime PoC: pps_fetch_timeout.c
- reproduce: build.sh / run.sh ; expected output in run.log
- fix.diff: present, git-apply-able
DF-2723 - Verification Verdict
Status: reproduced Impact: denial_of_service Confidence: certain
Mechanism
PPS_IOC_FETCH hands the user timespec straight to tstohz_low: ticks = (int)(sec*hz + (u_long)tv_nsec / nstick). An unnormalized tv_nsec (>= 1e9) overflows the int, so the sleep length is whatever the truncation leaves. On sio(4) EVERY unrecognized tty ioctl falls through to pps_ioctl (sio.c:2165-2172).
Verdict
REPRODUCED as root on the stock guest via /dev/ttyd0 (the sio console): sane {tv_sec=1,tv_nsec=0} returns ETIMEDOUT after 0.994 s; crafted {tv_sec=0, tv_nsec=2^62} computes (int)(2^62/1e7) = 1607101170 ticks (~186 days) and the fetch NEVER returns - the process had to be killed by timeout(1) at 40 s (exit 124), and the tsleep PCATCH/ERESTART cycle survives SIGALRM, so the sleep is effectively permanent. An attacker choosing the bit pattern chooses the tick count (including negative/0 variants). ttyd0 is 0600 root:wheel on this guest, so self-DoS of privileged callers.
Threat / reachability
Any openable pps-capable device turns one ioctl into an attacker-length uninterruptible sleep of the calling thread.
Privilege escalation assessment
n/a (thread hang; privileged fd on this guest)
Fix
Validate/normalize timeout (reject tv_nsec<0 or >=1000000000) in the PPS_IOC_FETCH handler before calling pps_fetch_timeout.
Kernel references
sys/kern/kern_clock.c:1618sys/kern/kern_clock.c:1265sys/kern/kern_clock.c:1643sys/dev/serial/sio/sio.c:2165
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Note: an earlier draft of this fix.diff failed the first combined build (see _batch41/README.md); the shipped diff is the corrected, compile-clean version.
Fix verification
not_testablefix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier
batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
Confirmed kernel references
Detail
Exploit chain
no escalation path: ttyd0 is 0600 root:wheel on this guest - privileged self-DoS (thread permanently hung in ppsfch)
Evidence (decisive lines)
run.log: sane {1,0} -> ETIMEDOUT after 0.994 s; crafted {0, 2^62} -> still sleeping at 40 s, killed by timeout(1) (exit 124); (int)(2^62/1e7)=1607101170 ticks = ~186 days
PoC changes
Rebuilt around /dev/ttyd0 (sio console): every unrecognized tty ioctl reaches pps_ioctl via the sio default case; added explicit timing, alarm guard and timeout(1) because the crafted sleep outlives SIGALRM (ERESTART re-enters tsleep).
Verified recommended fix
Validate/normalize timeout (reject tv_nsec<0 or >=1000000000) in the PPS_IOC_FETCH handler before calling pps_fetch_timeout.
Verdict
REPRODUCED as root on the stock guest via /dev/ttyd0 (the sio console): sane {tv_sec=1,tv_nsec=0} returns ETIMEDOUT after 0.994 s; crafted {tv_sec=0, tv_nsec=2^62} computes (int)(2^62/1e7) = 1607101170 ticks (~186 days) and the fetch NEVER returns - the process had to be killed by timeout(1) at 40 s (exit 124), and the tsleep PCATCH/ERESTART cycle survives SIGALRM, so the sleep is effectively permanent. An attacker choosing the bit pattern chooses the tick count (including negative/0 variants). ttyd0 is 0600 root:wheel on this guest, so self-DoS of privileged callers.
No comments yet.