DF-2769 — stale unix98 pty master re-open = session takeover (root command injection)

What it is

When the legitimate master of a unix98 pty closes while the slave side is still open (crashed xterm, dead tmux/screen server, killed script, nohup'd session leader), ptcclose() (sys/kern/tty_pty.c:637-689)

• clears t_oproc (:674) — disarming ptcopen's only "already has a master" gate (tty_pty.c:587),
• NULLs pt_prison (:676) — disarming ptcopen's jail isolation gate (tty_pty.c:580),
• sets both device nodes to uid 0 gid 0 mode 0666 (:677-682) — world openable,

while the pty is not terminated (termination requires !PF_SOPEN, tty_pty.c:273), so the master cdev /dev/ptm/N stays registered. ptcopen() then admits any local user as the new master of the still-live slave session. The TS_ZOMBIE fence set by ttymodem(0) (tty.c:1616-1630) is cleared by the new master itself: ptyioctl's master switch intercepts TIOCSETA* only to flush the outq and falls through to ttioctl, whose TIOCSETA/SETAW/SETAF handler clears TS_ZOMBIE when CLOCAL gets set (sys/kern/tty.c:1065-1072, 1077).

The new master then has, against the surviving session:

• input injection — ptcwrite() → l_rint → the victim's tty reads (the victim's shell executes it),
• output capture — ptcread() drains t_outq,
• signal injection — TIOCSIG → pgsignal(t_pgrp, sig, 1) with any signal < NSIG,
• device re-chown: the pty is re-owned to the attacker (tty_pty.c:616-621).

Unix98 semantics elsewhere (Linux, FreeBSD pts): after the master closes the pty is dead for everyone (slave gets EIO/SIGHUP, no new master can ever attach). DFly's master-cdev persistence + permissive ptcopen is the deviation.

Precondition (why this is not the default config)

/dev/ptm/* nodes are created DEVFS_HIDDEN (sys/vfs/devfs/devfs_core.c:2125-2133) and devfs_spec_open refuses hidden nodes (ENOENT). Exposure requires a devfs show rule covering ptm and its children — exactly what jail devfs rulesets / "expose /dev" recipes produce, applied any time after the node exists (the hide is re-applied at each ptm-node creation, devfs_core.c:2130, so rules applied at creation time lose; rules applied later — e.g. an admin devfsctl -a pass or a jail mount with a show-all ruleset — win). The PoC uses devfsctl as root to load show ptm + show ptm/*, modeling such a configuration; the kernel-side chain needs no privilege.

Reproduce

cc -O2 -Wall -o pty_master_hijack pty_master_hijack.c

# default config control (fenced):
./pty_master_hijack victim &           # prints UNIT=/dev/pts/N, closes master
./pty_master_hijack attack /dev/pts/N /tmp/cmd
# -> open /dev/ptm/N: No such file or directory(2), RESULT=FENCED

# with devfs rule exposing ptm (run.sh):
devfsctl -a -m /dev -f rules      # show ptm ; show ptm/*
./pty_master_hijack attack /dev/pts/N /tmp/cmd    # as ANY other user
# -> master opened, TS_ZOMBIE cleared via TIOCSETAW+CLOCAL,
#    command injected into the victim's tty; victim output readable

# decisive run: victim = ROOT-owned session, attacker = nobody,
# cmd = "id > /tmp/df2769_root_pwn"
# -> /tmp/df2769_root_pwn owned by root, content "uid=0(root) ..."

Fix

Refuse master re-open while the slave is still open (PF_SOPEN → EIO in ptcopen). PF_SOPEN can only be set after a previous master existed, so first-open behavior is unchanged. See fix.diff.

DF-2769 VERDICT

Status: reproduced — unprivileged (nobody) arbitrary command execution in a surviving ROOT pty session (uid=0 file created by the victim session), conditional on a devfs rule exposing /dev/ptm (fenced with ENOENT on the default ruleset).

Chain (all steps live-verified on stock INVARIANTS kernel #0)

1. Victim (root): posix_openpt → grantpt/unlockpt → ptsname → UNIT=/dev/pts/1; child: setsid + TIOCSCTTY, dup2 slave to stdio, signal(SIGHUP, SIG_IGN) (nohup semantics), loop reading tty lines and system()-ing them; parent closes the master fd at t+1s and exits → models a crashed xterm/tmux-server with the session alive. After ptcclose: t_oproc=NULL (tty_pty.c:674), pt_prison=NULL (:676), devs/devc → 0:0 mode 0666 (:677-682); termination blocked by PF_SOPEN (:273); ttymodem(0) set TS_ZOMBIE + SIGHUP (ignored).
2. Control (default devfs): attacker open("/dev/ptm/1") → ENOENT (DEVFS_HIDDEN, devfs_core.c:2125-2133 + devfs_spec_open accessibility check) — captured in run.log as RESULT=FENCED.
3. Precondition (root, once): devfsctl -a -m /dev -f rules with show ptm + show ptm/* — /dev/ptm/1 becomes visible crw-rw-rw- root:wheel. This models jail/"expose /dev" rulesets; note the kernel re-hides at each new ptm node creation, so exposure occurs whenever rules are (re)applied after creation — e.g. any later devfsctl pass or a jail devfs mount with a showing ruleset.
4. Attacker (nobody): open("/dev/ptm/1", O_RDWR) → succeeds (ptcopen gates all disarmed). TIOCGETA + TIOCSETAW with c_cflag |= CLOCAL → ttioctl tty.c:1065-1072 clears TS_ZOMBIE (log: "TS_ZOMBIE cleared via TIOCSETAW+CLOCAL").
5. write(master, "id > /tmp/df2769_root_pwn\n") → ptcwrite → l_rint → victim's fgets executes system("id > /tmp/df2769_root_pwn") as root; attacker read() the echoed line and "[victim rc=0]".
6. Result: /tmp/df2769_root_pwn owned by root, content uid=0(root) gid=0(wheel) ....

Impact

With /dev/ptm exposed (jail rulesets, devfs.conf show rules), any local user hijacks any still-open pty session whose master died: command injection as the session owner (root sessions → uid 0), terminal output capture (secrets/passwords typed in the session), arbitrary-signal injection (TIOCSIG), and device re-chown lockout. On the default devfs ruleset the by-name path is ENOENT-fenced; the kernel-side defect is unchanged.

Not-a-bug notes

• Same-uid re-mastering is equally possible (weaker demo).
• The reclaim of fully-closed-but-session-referenced ptys (t_refs>0 zombie units, DF-2687 state) is a related but distinct window; the PF_SOPEN fence in fix.diff deliberately leaves it untouched.

Fix validation

Combined patch (DF-2768+DF-2769 hunks) built (make -j6 nativekernel && make installkernel) and booted in the guest; re-running the attack (with the devfs rule re-applied) the stale master open then fails with EIO (fence hit) and no injection occurs; victim session stays ZOMBIE. See fix run logs.

Kernel references

• sys/kern/tty_pty.c:636-689 (ptcclose disarms all gates, 0666)
• sys/kern/tty_pty.c:560-634 (ptcopen admission: 571-573 si_drv1, 580-584 prison, 585-592 t_oproc — none fence the stale case)
• sys/kern/tty_pty.c:273-293 (termination gated on !PF_SOPEN)
• sys/kern/tty_pty.c:745-750 + 1049-1055 (TS_CONNECTED/EOF paths)
• sys/kern/tty_pty.c:1081-1275 (ptyioctl master fallthrough to ttioctl)
• sys/kern/tty.c:1060-1080 (TIOCSETA* CLOCAL clears TS_ZOMBIE)
• sys/kern/tty.c:1600-1650 (ttymodem ZOMBIE/SIGHUP on carrier loss)
• sys/vfs/devfs/devfs_core.c:2068-2133 (node creation + ptm hide)
• sys/vfs/devfs/devfs_core.c:2598-2603 + devfs_vnops.c:867-869 (DEVFS_HIDDEN → ENOENT fence)
• sys/vfs/devfs/devfs_rules.c:325-331 (show rule clears DEVFS_HIDDEN)