DF-2794

sys_lwp_rtprio() with tid == -1 ignores the target pid and always operates on the caller's own lwp

Field	Value
ID	DF-2794
Status	new
Severity	Info
CVSS 3.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
CWE	CWE-670 Inconsistent Implementation
File	sys/kern/kern_resource.c
Lines	588-593
Area	kern
Confidence	certain
Discovered	2026-08-31
Pass	2 (GLM 5.3 second pass)
Bucket	base:kern
Reported	pending
Known CVE	none
CVE match	novel

Summary

tid == -1 ("sadly, tid can be 0 so we can't use 0 here") resolves lp = curthread->td_lwp regardless of uap->pid. RTP_SET/RTP_LOOKUP with pid=, tid=-1 checks credentials against the TARGET process but then reads/writes the CALLER's own lwp. All privilege checks remain on the caller's credential — no security boundary crossed; silently mis-targets the operation (e.g. a root process intending to set another process's first lwp instead modifies its own).

Recommended fix

When pid != 0 and tid == -1, resolve lp from the target (FIRST_LWP_IN_PROC(p) with the DF-2791 NULL check), or reject the combination with EINVAL.

Timeline

2026-08-31 Discovered during pass-2 audit of kern_resource.c (GLM 5.3).

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Privilege escalation (general use)
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
CWE: CWE-670
File: sys/kern/kern_resource.c
Lines: 588-593
Area: kern
Discovered: 2026-09-01
Updated: 2026-09-01

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: certain
Tested: 2026-10-26 02:18:29
Attempts: 2
Runtime: 90s
Code hash: 215785cda0c95d7b
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: cc -Wall -O2 -o rtprio_tid rtprio_tid.c
Run cmd: ./rtprio_tid (as root)

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-10-26 02:18:29
Runtime: —
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)
fix.diff: findings/poc/DF-2794/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2794 · 10 files

File	Type	Size
README.md	—	706 B	↓ raw
VERDICT.md	—	947 B	↓ raw
build.sh	—	69 B	view raw
env.txt	—	509 B	view raw
fix.diff	—	640 B	view raw
manifest.json	—	545 B	view raw
rtprio_tid.c	—	1.5 KB	view raw
run.log	—	150 B	view raw
run.sh	—	83 B	view raw
verdict.json	—	2.3 KB	view raw

README.md

↓ download raw

DF-2794 — sys_lwp_rtprio tid==-1 mis-targets caller lwp (Info-tier hardening verification)

What

sys_lwp_rtprio tid==-1 mis-targets caller lwp

Build

cc -Wall -O2 -o rtprio_tid rtprio_tid.c

Run

./rtprio_tid (as root)

Expected

baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone

Files

README.md VERDICT.md build.sh env.txt fix.diff manifest.json rtprio_tid.c run.log run.sh verdict.json

Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven). Full batch context: the fix kernel contains all 41 hardening fixes of this batch compiled together (build RC=0) and passed the complete A/B suite plus a clean reboot.

VERDICT.md

↓ download raw

DF-2794 — VERDICT

status: reproduced | reproduced: 1 | impact: none | confidence: certain

Mechanically reproduced as root on the stock guest: fork a child; lwp_rtprio(RTP_SET, pid=child, tid=-1, {RTP_PRIO_REALTIME,31}) returns 0 (success), and the CALLER parent's own rtprio then reads back type=0 prio=31 while the call was directed at the child pid - sys_lwp_rtprio resolves lp = curthread->td_lwp whenever tid==-1 regardless of the target pid (kern_resource.c:588-593 region), with the EPERM credentials check still evaluated against the TARGET process ucred (no privilege boundary is crossed; unprivileged RTP_SET on another pid is refused before any mis-targeting). On the fix kernel the same call leaves the parent at type=1 prio=0 (normal) and returns success - the operation went to the target process's first LWP.

Baseline vs fix kernel

baseline: see verdict above / run log fix: behavior changed as designed (see verdict)

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

A/B: baseline parent becomes REALTIME/31 from a child-directed call; fix kernel parent stays NORMAL - the tid==-1 case now resolves from the target process (RB_ROOT with NULL check) when pid differs.

↓ fix.diffDragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)

Confirmed kernel references

Detail

Evidence (decisive lines)

run.log baseline: parent type 1->0 prio 0->31 after a child-directed RTP_SET; fix kernel: parent unchanged (type=1 prio=0)

PoC changes

libc provides lwp_rtprio(3); RTP_real is RTP_PRIO_REALTIME on DragonFly; SYS number 498

Verified recommended fix

When pid differs from curproc resolve the target first LWP (RB_ROOT + ESRCH on empty)

Verdict

Mechanically reproduced as root on the stock guest: fork a child; lwp_rtprio(RTP_SET, pid=child, tid=-1, {RTP_PRIO_REALTIME,31}) returns 0 (success), and the CALLER parents own rtprio then reads back type=0 prio=31 while the call was directed at the child pid - sys_lwp_rtprio resolves lp = curthread->td_lwp whenever tid==-1 regardless of the target pid (kern_resource.c:588-593 region), with the EPERM credentials check still evaluated against the TARGET process ucred (no privilege boundary is crossed; unprivileged RTP_SET on another pid is refused before any mis-targeting). On the fix kernel the same call leaves the parent at type=1 prio=0 (normal) and returns success - the operation went to the target processs first LWP.