Unbounded vmspace allocation in sys_vmspace_create: no per-process cap, each create pins a wired PML4 page + 8KB KVA + vmspace struct → unprivileged kernel-memory exhaustion DoS (requires vm.vkernel_enable=1)
| Field | Value |
|---|---|
| ID | DF-2834 |
| Status | new |
| Severity | Medium |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-770 Allocation of Resources Without Limits |
| File | sys/vm/vm_vmspace.c |
| Lines | 146-201 (chain vm_map.c:309-340 → pmap.c:2368-2387) |
| Area | vm |
| Confidence | certain |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vm |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
sys_vmspace_create has no limit on how many vmspaces a process may create. Each successful create allocates a vmspace_entry, a full vmspace, and via pmap_pinit a 2-page kmem_alloc_pageable KVA allocation plus a WIRED PML4 vm_page, and pmap_pinit2. An unprivileged loop with distinct ids grows unswappable kernel memory and wired pages without any rlimit or sysctl cap — unlike mmap entries (capped by vm.max_proc_mmap). Exhaustion is system-wide (wired-page/KVA starvation wedging or panicking the machine). Gated by vm.vkernel_enable=1 (root tunable, default 0 — but exactly the configuration on any vkernel host). Same reachability class as DF-0952: no privilege check beyond p_vkernel != NULL. Allocation chain fully source-proven; live OOM run deferred (would wedge the single-tenant guest).
Recommended fix
Per-vkernel_proc cap on live vmspaces checked under vkp->token, mirroring the vm.max_proc_mmap pattern (vm.max_vkernel_vmspaces sysctl, default 64) — sketch diff in the row above / pack.
Timeline
- 2026-08-31 Discovered during pass-2 audit of vm_vmspace.c (GLM 5.3).
No comments yet.