DF-2927 — debug.dump_modinfo sysctl discloses kernel pointers to any local user

What

sys/kern/subr_module.c:447-450 registers debug.dump_modinfo (CTLTYPE_STRING | CTLFLAG_RD). DragonFly's sysctl read path applies no privilege check to reads (sys/kern/kern_sysctl.c:1436-1448 gates only writes via SYSCAP_NOSYSCTL_WR; CTLFLAG_SECURE also only suppresses writes at securelevel>0). The handler dumps the entire bootloader metadata TLV list, including:

• every TLV's own kernel virtual address — sbuf_printf(sbp, " %p:\n", bptr) (sys/kern/subr_module.c:411)
• kernel base (MODINFO_ADDR), kernel size, and the load address of every loader-preloaded module (ehci.ko, xhci.ko on the test guest)
• MODINFOMD_SSYM/ESYM — exact kernel symbol-table range
• MODINFOMD_DYNAMIC — _DYNAMIC address
• MODINFOMD_ENVP — address of the static boot environment block (DF-2894 context: this is the array kern_envp walks)
• MODINFOMD_KERNEND

Build

Nothing to compile — the "PoC" is a stock userland binary:

./build.sh          # no-op; explains the trigger

Run

./run.sh            # ssh to the guest, runs the sysctl as uid 1001

or directly on any DragonFly host: sysctl -n debug.dump_modinfo as any non-root user.

Expected output (observed on the audit guest, uid=1001)

 0xffffffff81de4000:
    type:   (0x01) MODINFO_NAME
    len:    20
    value:  /boot/kernel/kernel
 ...
    type:   (0x03) MODINFO_ADDR
    len:    8
    value:  0xffffffff80200000            <-- kernel base
 ...
    type:   (0x8003) MODINFO_METADATA | MODINFOMD_SSYM
    value:  0xffffffff81b25e40            <-- symtab start
    type:   (0x8004) MODINFO_METADATA | MODINFOMD_ESYM
    value:  0xffffffff81cd8538            <-- symtab end
    type:   (0x8006) MODINFO_METADATA | MODINFOMD_ENVP
    value:  0x0000000001de3000            <-- kern_envp block

Success criterion: a non-root uid receives the dump (exit 0, pointer values present). Failure after fix: sysctl: unknown oid 'debug.dump_modinfo' is fine too — no; expected post-fix behavior is Operation not permitted for non-root, success for root.

The output is deterministic across reads (identical MD5 over 3 runs — run.log).

DF-2927 — VERDICT

Status: reproduced (3/3 runs, deterministic) · Impact: leak (kernel pointer / memory-layout disclosure to unprivileged local users) · Confidence: certain

What was tested

Whether an unprivileged local user can read sysctl debug.dump_modinfo (sys/kern/subr_module.c:447-450), which pretty-prints the entire bootloader-supplied metadata TLV list — including kernel virtual addresses.

Result

On the stock audit guest (see env.txt), uid=1001(maxx):

• sysctl -n debug.dump_modinfo exits 0 and returns the full 26-TLV dump (run.log, leak_sample.txt).
• Output is byte-identical across 3 consecutive reads (MD5 242807fbad7a6d778cfb0f46fd458a32, run.2.log) — the leak is stable and trivially parseable.

What is actually disclosed

From preload_dump_internal / preload_modinfo_value (sys/kern/subr_module.c:365-427):

Root cause

sysctl_preload_dump (sys/kern/subr_module.c:429-445) performs no credential check. DragonFly's generic sysctl layer only gates writes (sys/kern/kern_sysctl.c:1445-1448, SYSCAP_NOSYSCTL_WR on req->newptr); reads of non-CTLFLAG_SECURE OIDs are unrestricted for local users, and the SYSCAP_NODEBUG_UNPRIV gate that protects the comparable sysctl.sysctl_debug tree dumper (sys/kern/kern_sysctl.c:649) is not applied to OIDs under the debug top-level node.

Why it matters / impact ceiling

• Discloses the exact runtime KVA layout: kernel base, module load addresses, symtab bounds — full reconnaissance for any KASLR or KVA-hardening scheme (stock DF pc64 currently has no kernel-base randomization, which caps practical severity at Low today).
• Reveals the location of the static boot-environment block (ENVP), the memory kern_envp walks (see DF-2894) — useful targeting data.
• Requires zero privileges, zero setup, works on default installs.

Not memory corruption; no escalation path by itself. Ceiling: reliable, deterministic kernel-layout leak.

Fix

fix.diff gates the handler with the same capability check used by sysctl.sysctl_debug (SYSCAP_NODEBUG_UNPRIV). Post-fix expectation: non-root gets EPERM ("Operation not permitted"), root unchanged.

Fix validation: not_testable-in-run — a kernel rebuild cycle for a one-line permission gate on a Low finding was judged out of proportion for this run (no memory-corruption reproduction, which is what mandates the rebuild per contract). The change mirrors an existing, proven gate at sys/kern/kern_sysctl.c:649 verbatim.

Files

• run.log — decisive unprivileged run (uid=1001, full dump), untrimmed
• run.2.log — determinism check (3× identical MD5)
• leak_sample.txt — full 26-TLV dump as captured from the guest
• env.txt — guest uname / securelevel / root cred context
• fix.diff — the one-line privilege gate