⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2736

vop_compat_* '[diagnostic] EAGAIN on ncp %p %s' prints leak kernel namecache heap pointer and full pathname into the world-readable msgbuf

Field Value
ID DF-2736
Status new
Severity Low
CVSS 3.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE CWE-532 Sensitive Information in Log
File sys/kern/vfs_default.c
Lines 200, 329, 408, 488, 567, 643, 726, 813, 883, 984, 1033
Area kern
Confidence likely
Discovered 2026-08-30
Pass 2 (GLM 5.3 second pass)
Bucket kernleak
Reported pending
Known CVE none
CVE match novel

Summary

Ten error paths in the VFS new-API-to-old-API compatibility fallbacks (vop_compat_nresolve/ncreate/nmkdir/nmknod/nlink/nsymlink/nwhiteout/ nremove/nrmdir/nrename) print kprintf("[diagnostic] vop_compat_resolve: EAGAIN on ncp %p %s\n", ncp, ncp->nc_name) whenever vget(dvp, LK_EXCLUSIVE) fails — exactly when the directory vnode is concurrently reclaimed, a race an unprivileged local user widens by churning lookups/creates against vnode-cache pressure on hot directories. The message discloses the exact kernel virtual address of the struct namecache (namecache slab object) plus the entry name. DragonFly's kernel message buffer is readable by any user by default (security.unprivileged_read_msgbuf defaults to 1) — defeats heap-address randomization and aids slab-grooming attacks chaining off any other bug. Same class as DF-0920/DF-2614/DF-2637/DF-2689.

Drop the %p (and ideally rate-limit or KTR the print) at all ten sites: kprintf("[diagnostic] vop_compat_resolve: EAGAIN on ncp %s\n", ncp->nc_name);

Timeline

  • 2026-08-30 Discovered during pass-2 audit of vfs_default.c (GLM 5.3).

Discussion (0)

No comments yet.