DF-2868
ktrcanset dereferences targetp->p_ucred with no token and no crhold — freed-cred read / stale-cred TOCTOU racing cratom_proc (distinct from DF-0103's p_tracenode scope)
| Field | Value |
|---|---|
| ID | DF-2868 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CWE | CWE-367 / CWE-416 |
| File | sys/kern/kern_ktrace.c |
| Lines | ktrcanset (:668-684 self-grant area) |
| Area | kern |
| Confidence | speculative |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | memcorrupt |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
ktrcanset dereferences targetp->p_ucred with no token and no crhold,
racing cratom_proc's swap+crfree and the per-thread td_ucred refresh —
a freed-cred read / stale-cred TOCTOU (stale cr_uid check decides
whether the tracer may attach). Distinct from DF-0103's p_tracenode
scope. Nanosecond window; Phase V skipped (Low/speculative per
contract). Fix: take target's p_token (shared) + crhold around the
check, mirroring the pcredcache discipline.
Timeline
- 2026-09-02 Discovered during pass-2 audit of kern_ktrace.c (GLM 5.3).
No comments yet.