DF-2805
UDEVWAIT ioctl dereferences the userspace pointer directly (missing copyin/copyout) — kernel panic on any unmapped a_data
| Field | Value |
|---|---|
| ID | DF-2805 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-755 Improper Handling of Exceptional Conditions |
| File | sys/kern/kern_udev.c |
| Lines | 919-936 (contrast proplib ioctls :892/:1011) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
The UDEVWAIT handler reads/writes its ioctl argument with raw kernel
dereferences of the user-supplied pointer (seq = *(int
*)ap->a_data; *(int *)ap->a_data = udev_seq) instead of
copyin/copyout. On x86_64 a kernel-mode access to an unmapped user
address takes a page fault with no onfault handler and panics.
Reachable only through /dev/udev (0600 root:wheel) — Low, but an
any-moment robustness landmine. Fix: copyin/copyout (row diff).
Timeline
- 2026-08-31 Discovered during pass-2 audit of kern_udev.c (GLM 5.3).
No comments yet.