DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2856

Whole-chunk reuse path inherits previous owner's r_virtual/r_bustag/r_bushandle/r_rid and stale RF_SHAREABLE bit — cross-driver data hygiene leak via rman_get_* accessors

Field Value
ID DF-2856
Status new
Severity Info
CVSS 3.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CWE CWE-908 / CWE-459
File sys/kern/subr_rman.c
Lines 257-263, 347, 594
Area kern
Confidence likely
Discovered 2026-09-02
Pass 2 (GLM 5.3 second pass)
Bucket base:kern
Reported pending
Known CVE none
CVE match novel

Summary

int_rman_release_resource only clears RF_ALLOCATED, and the whole-chunk takeover path ORs flags and sets r_dev without resetting r_virtual, r_bustag, r_bushandle or r_rid — a re-allocated chunk carries the PREVIOUS owner's mapping pointer and bus handle, readable by the new owner via rman_get_virtual()/rman_get_bushandle() if the driver reads before writing. The stale RF_SHAREABLE bit also persists on free fragments, so a later RF_SHAREABLE request can share a region whose current owner did not request sharing. Kernel-internal caller-contract weakness; hardening. Fix: clear the fields on release/takeover.

Timeline

  • 2026-09-02 Discovered during pass-2 audit of subr_rman.c (GLM 5.3).

Discussion (0)

No comments yet.