sys_setlogin mutates s_login while holding p_token SHARED — data race with concurrent setlogin/getlogin produces torn login names
| Field | Value |
|---|---|
| ID | DF-2761 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-667 Improper Locking |
| File | sys/kern/kern_prot.c |
| Lines | 1290-1292 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
sys_setlogin performs the s_login memcpy under lwkt_gettoken_shared(&p->p_token). Shared tokens do not exclude other shared holders: two privileged processes in the same session racing setlogin() write the full MAXLOGNAME array concurrently, and any getlogin() reader (also shared) can observe a torn mix. No memory unsafety; privilege-gated; purely locking-discipline/correctness (utmp/audit can read a garbage login name).
Recommended fix
Use the exclusive token for the writer (readers may stay shared):
lwkt_gettoken(&p->p_token); at :1290.
Timeline
- 2026-08-30 Discovered during pass-2 audit of kern_prot.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2761 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.4 KB | ↓ raw | |
| README.md | — | 245 B | ↓ raw | |
| build.sh | — | 100 B | view raw | |
| run.sh | — | 70 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 639 B | view raw | |
| verdict.json | — | 1.8 KB | view raw | |
| fix.diff | — | 366 B | view raw | |
| setlogin_race.c | — | 1.7 KB | view raw | |
| run.log | — | 456 B | view raw |
DF-2761 evidence pack
- finding: sys/kern/kern_prot.c (1290-1292)
- verdict: reproduced (certain) - see VERDICT.md
- runtime PoC: setlogin_race.c
- reproduce: build.sh / run.sh ; expected output in run.log
- fix.diff: present, git-apply-able
DF-2761 - Verification Verdict
Status: reproduced Impact: none (hardening) Confidence: certain
Mechanism
sys_setlogin mutates p_pgrp->pg_session->s_login (32-byte memcpy) while holding p_token SHARED (lwkt_gettoken_shared); shared tokens do not exclude each other, so two concurrent setlogin calls interleave mid-memcpy and concurrent getlogin observes torn names.
Verdict
REPRODUCED as root on the stock guest: two writer threads setlogin(A32)/setlogin(B32) plus a reader thread; 105318 of 7103819 getlogin observations returned MIXED A/B names (samples: AAAAAAAAAAAAAAAAAAAAAAAABBBBBBBB). The 32-byte s_login store is torn exactly as predicted by the shared-token analysis.
Threat / reachability
Root-gated integrity/race hardening (SYSCAP_NOPROC_SETLOGIN); torn login names visible to getlogin/last/audit consumers.
Privilege escalation assessment
n/a (root-gated; integrity only)
Fix
Take p_token EXCLUSIVE (lwkt_gettoken) for the mutation.
Kernel references
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier
batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
Confirmed kernel references
Detail
Exploit chain
no escalation path: setlogin is SYSCAP-gated; integrity-only (torn login names)
Evidence (decisive lines)
run.log: 105318 of 7103819 getlogin reads returned MIXED A/B names (samples logged), proving the shared-token memcpy interleaves
PoC changes
none; 3-thread rig (2 writers + reader) as seeded
Verified recommended fix
Take p_token EXCLUSIVE (lwkt_gettoken) for the mutation.
Verdict
REPRODUCED as root on the stock guest: two writer threads setlogin(A32)/setlogin(B32) plus a reader thread; 105318 of 7103819 getlogin observations returned MIXED A/B names (samples: AAAAAAAAAAAAAAAAAAAAAAAABBBBBBBB). The 32-byte s_login store is torn exactly as predicted by the shared-token analysis.
No comments yet.