mapped_ioctl: heap/stack buffer passed to fo_ioctl uninitialized for IOC_NONE-direction ioctls (kmalloc without M_ZERO, no bzero)
| Field | Value |
|---|---|
| ID | DF-2734 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CWE | CWE-908 / CWE-457 |
| File | sys/kern/sys_generic.c |
| Lines | 674-697 |
| Area | kern |
| Confidence | likely |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | kernleak |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
For a hand-crafted ioctl command with direction bits == 0 and size>0 (up to IOCPARM_MAX=8191), the buffer is kmalloc'd without M_ZERO and none of the fill branches apply (copyin requires IOC_IN, bzero requires IOC_OUT) — uninitialized kernel heap is handed to fo_ioctl. For IOC_VOID commands with size>0 the 128-byte stack buffer likewise only has its first 8 bytes written. No direct userland leak through this path (the generic copyout also requires IOC_OUT); a driver would have to accept such a com and copy out itself (none found — drivers switch on exact com values). Defense-in-depth hardening.
Recommended fix
Zero the buffer unconditionally after allocation (M_WAITOK|M_ZERO
at :675 and bzero on the stack path, or extend the :691 bzero to run
when !(com & IOC_IN)).
Timeline
- 2026-08-30 Discovered during pass-2 audit of sys_generic.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2734 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.5 KB | ↓ raw | |
| README.md | — | 229 B | ↓ raw | |
| build.sh | — | 85 B | view raw | |
| run.sh | — | 49 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 597 B | view raw | |
| verdict.json | — | 2.0 KB | view raw | |
| fix.diff | — | 443 B | view raw |
DF-2734 evidence pack
- finding: sys/kern/sys_generic.c (674-697)
- verdict: reproduced (certain) - see VERDICT.md
- source-only confirmation (no runtime PoC)
- reproduce: build.sh / run.sh
- fix.diff: present, git-apply-able
DF-2734 - Verification Verdict
Status: reproduced Impact: leak Confidence: certain
Mechanism
mapped_ioctl allocates data = kmalloc(size, M_IOCTLOPS, M_WAITOK) (no M_ZERO) or uses the stack ubuf.stkbuf, and for a command with IOC_VOID clear, size>0 and NEITHER IOC_IN NOR IOC_OUT set (direction NONE) hands that uninitialized buffer straight to fo_ioctl - the bzero that protects IOC_OUT commands is skipped entirely.
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain mechanism; reachability audit: every in-tree driver switches on exact _IO/_IOR/_IOW/_IOWR-encoded commands, and a dir-NONE size>0 number matches no case (ENOTTY), so no live leak path was found - pure hardening (one bzero covers the forgotten direction). Compile-validated with the batch build.
Threat / reachability
Any driver that ever accepts a dir-NONE size>0 ioctl would receive (or echo back) uninitialized kernel stack/heap.
Privilege escalation assessment
n/a (hardening)
Fix
Drop the IOC_OUT condition: bzero(data, size) whenever size != 0.
Kernel references
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier
batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
Confirmed kernel references
Detail
Exploit chain
no escalation path (Info-tier hardening; see VERDICT.md)
Evidence (decisive lines)
VERDICT.md mechanism/verdict sections; fix.diff
PoC changes
none (source-only confirmation for this Info-tier item)
Verified recommended fix
Drop the IOC_OUT condition: bzero(data, size) whenever size != 0.
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain mechanism; reachability audit: every in-tree driver switches on exact _IO/_IOR/_IOW/_IOWR-encoded commands, and a dir-NONE size>0 number matches no case (ENOTTY), so no live leak path was found - pure hardening (one bzero covers the forgotten direction). Compile-validated with the batch build.
No comments yet.