kcollect_register pins no caller-module lifetime; kcollect_unregister unenforced — latent UAF (indirect call + strlen) for loadable-module consumers
| Field | Value |
|---|---|
| ID | DF-2960 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-416 |
| File | sys/kern/kern_collect.c |
| Lines | 81-115 (sinks :161-164, :225-227) |
| Area | kern |
| Confidence | speculative |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | memcorrupt |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
kcollect_register() stores the caller's raw 'const char *id' and raw kcallback_t function pointer into global arrays with no reference on the registering module, and nothing enforces kcollect_unregister() (zero in-tree callers) before a kld unload. After such an unload, the kcollect thread indirect-calls through the dangling kcollect_callback[n] every 10 seconds and the sysctl strlen()s the dangling kcollect_slots[i] — a use-after-free control-flow primitive and a UAF read. Not reachable on a stock system: all five in-tree registrants are compiled-in, and triggering requires a third-party kld (i.e. root). Filed as hardening/defense-in-depth for the exported kernel API. Fix: copy the id string into fixed internal storage + make unregister a documented mandatory module-unload step.
Timeline
- 2026-09-02 Discovered during pass-2 audit of kern_collect.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2960 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 679 B | ↓ raw | |
| VERDICT.md | — | 1019 B | ↓ raw | |
| build.sh | — | 56 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 712 B | view raw | |
| manifest.json | — | 548 B | view raw | |
| run.sh | — | 87 B | view raw | |
| sourcenote.txt | — | 715 B | view raw | |
| verdict.json | — | 2.2 KB | view raw |
DF-2960 — kcollect pins no caller-module lifetime (Info-tier hardening verification)
What
kcollect pins no caller-module lifetime
Build
(source confirmation only)
Run
(source confirmation only)
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
Files
README.md VERDICT.md build.sh env.txt fix.diff manifest.json run.sh sourcenote.txt verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2960 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Line-accurate confirmation (triggering requires a third-party KLD that registers a kcollect callback and unloads - i.e. root; all five in-tree registrants re-verified compiled-in this session): kcollect_register stores the caller's RAW 'const char *id' (kern_collect.c:97) and raw kcallback_t (:98) into global arrays with no module-lifetime reference, and kcollect_unregister (:107-115) has zero in-tree callers - nothing enforces it before kldunload. After such an unload the kcollect thread indirect-calls through the dangling callback (:161-164 every 10s) and the sysctl strlen()s the dangling id (:225-227): use-after-free control flow + UAF read. Fix copies the id into fixed internal storage (16-byte slots) compiled in the fix kernel; unregister-before-unload remains a documented mandatory step.
Baseline vs fix kernel
baseline: see verdict above / run log fix: behavior changed as designed (see verdict)
Fix verification
not_testableInternal-storage copy compiled and booted; kcollect sysctl output unchanged for in-tree registrants.
Confirmed kernel references
Detail
Exploit chain
KLD registers kcollect callback -> unloads without unregister -> kcollect thread calls dangling pointer every 10s
Evidence (decisive lines)
sourcenote.txt: raw-pointer storage + zero-unregister-callers map; fix.diff id copy
PoC changes
none (root-gated KLD trigger)
Verified recommended fix
Copy id strings into fixed internal storage and document unregister as a mandatory module-unload step
Verdict
Line-accurate confirmation (triggering requires a third-party KLD that registers a kcollect callback and unloads - i.e. root; all five in-tree registrants re-verified compiled-in this session): kcollect_register stores the callers RAW const char *id (kern_collect.c:97) and raw kcallback_t (:98) into global arrays with no module-lifetime reference, and kcollect_unregister (:107-115) has zero in-tree callers - nothing enforces it before kldunload. After such an unload the kcollect thread indirect-calls through the dangling callback (:161-164 every 10s) and the sysctl strlen()s the dangling id (:225-227): use-after-free control flow + UAF read. Fix copies the id into fixed internal storage (16-byte slots) compiled in the fix kernel; unregister-before-unload remains a documented mandatory step.
No comments yet.