⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2900

procfs_rwmem ignores kmem_alloc_pageable failure — kva=0 reaches pmap_kenter_quick(0,pa), overwriting pml4[0] of the current user pmap (page-table pivot) plus uiomove on VA 0

Field Value
ID DF-2900
Status new
Severity Low
CVSS 3.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE CWE-252 / CWE-476
File sys/vfs/procfs/procfs_mem.c
Lines 101, 147-148, 161 (contract: vm_kern.c:163-179)
Area vfs/procfs
Confidence likely
Discovered 2026-09-02
Pass 2 (GLM 5.3 second pass — vm_kern.c row)
Bucket privesc
Reported pending
Known CVE none
CVE match novel

Summary

kmem_alloc_pageable() documents returning 0 on failure (vm_map_find error → return 0, vm_kern.c:176-178). procfs_rwmem() stores the result in kva without any check (procfs_mem.c:101). Every unprivileged user reaches this via pread/pwrite on /proc//mem (CHECKIO/p_trespass pass for curp==p). If the allocation fails, kva=0 flows into: (a) pmap_kenter_quick(0, VM_PAGE_TO_PHYS(m)) at :147 — on pc64, vtopte(0)=PTmap+0 and PTmap=KVADDR(PML4PML4I,0,0,0), i.e. the recursive self-map aliasing the PML4 page itself, so atomic_swap_long in pmap.c overwrites pml4[0] of the current user pmap with pa|RW|V where pa is the traced process's page whose contents the attacker fully controls (trace yourself) — a fake-PDPT pivot giving arbitrary physical-memory R/W from userspace (full uid=0 ceiling) if ever triggered; (b) uiomove on VA 0; (c) kmem_free(kernel_map, 0, PAGE_SIZE) — verified harmless (range clamp no-ops). Trigger requires kernel_map KVA exhaustion (vm_map_entry_reserve blocks rather than fails; x86_64 KVA far beyond unpriv reach) — Low, speculative trigger, page-table-pivot consequence.

if (kva == 0) { vmspace_drop(vm); return (ENOMEM); } after :101.

Timeline

  • 2026-09-02 Discovered during pass-2 audit of vm_kern.c (GLM 5.3); caller-discipline defect, consequence verified by code trace.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2900 · 6 files
FileTypeDescriptionSize
README.md — 597 B ↓ raw
VERDICT.md — 1.9 KB ↓ raw
env.txt — 401 B view raw
fix.diff — 344 B view raw
manifest.json — 522 B view raw
verdict.json — 1.8 KB view raw
README.md
↓ download raw

DF-2900 PoC evidence pack

What

procfs_rwmem ignores kmem_alloc_pageable failure: kva=0 reaches pmap_kenter_quick(0, pa).

Build

(none)

Run

(none)

Expected

static confirmation: kmem_alloc_pageable returns 0 (vm_kern.c:176-178); call site unchecked

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 All logs are full untrimmed captures unless noted. fix.diff is the git-apply-able verified fix (authored after verification; never applied to the audit tree).

VERDICT.md
↓ download raw

DF-2900 - verification verdict

Status: not_reproduced | reproduced: 0 | impact: arbitrary_write | confidence: speculative

The unchecked failure return is real: kmem_alloc_pageable returns 0 on vm_map_find failure (vm_kern.c:176-178 confirmed) and procfs_rwmem stores kva at procfs_mem.c:101 with no check, then pmap_kenter_quick(kva, pa) at :147 and kmem_free(kernel_map, 0, PAGE_SIZE) at :161. The claimed trigger (kernel_map KVA exhaustion on x86_64) is not honestly constructible: kernel_map VA space is effectively unbounded relative to any unpriv-reachable allocation rate, and vm_map entry allocation blocks rather than fails under pressure. Unpriv reachability of the surrounding path (pread/pwrite /proc/own-pid/mem) is trivial and untested-here only because the trigger condition cannot be reached. The page-table-pivot consequence analysis (vtopte(0) aliasing the PML4 self-map on pc64) is consistent with the code but remains untriggered. Fix (kva==0 -> ENOMEM) compiled.

Evidence pointers

vm_kern.c:176-178 returns 0; procfs_mem.c:101/:147/:161 use it unchecked

Kernel references

PoC changes vs the filing sketch

trigger infeasible; static confirmation

Fix

recommendation: if (kva == 0) { vmspace_drop(vm); return ENOMEM; }

fix status: not_testable

compile-validated in fix-all kernel

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

not_testable

compile-validated in fix-all kernel

↓ fix.diffper-fix-DF-2900

Confirmed kernel references

Detail

Evidence (decisive lines)

vm_kern.c:176-178 returns 0; procfs_mem.c:101/:147/:161 use it unchecked

PoC changes

trigger infeasible; static confirmation

Verified recommended fix

if (kva == 0) { vmspace_drop(vm); return ENOMEM; }

Verdict

The unchecked failure return is real: kmem_alloc_pageable returns 0 on vm_map_find failure (vm_kern.c:176-178 confirmed) and procfs_rwmem stores kva at procfs_mem.c:101 with no check, then pmap_kenter_quick(kva, pa) at :147 and kmem_free(kernel_map, 0, PAGE_SIZE) at :161. The claimed trigger (kernel_map KVA exhaustion on x86_64) is not honestly constructible: kernel_map VA space is effectively unbounded relative to any unpriv-reachable allocation rate, and vm_map entry allocation blocks rather than fails under pressure. Unpriv reachability of the surrounding path (pread/pwrite /proc/own-pid/mem) is trivial and untested-here only because the trigger condition cannot be reached. The page-table-pivot consequence analysis (vtopte(0) aliasing the PML4 self-map on pc64) is consistent with the code but remains untriggered. Fix (kva==0 -> ENOMEM) compiled.