devfs_find_device_by_devid/name return an unreferenced cdev: kern.devname sysctl (CTLFLAG_ANYBODY) reads si_name after devfs_lock is released — microscopic UAF-read race
| Field | Value |
|---|---|
| ID | DF-3008 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-367 / CWE-416 (read) |
| File | sys/vfs/devfs/devfs_core.c |
| Lines | 1659-1673, 910-933, 2786-2789 |
| Area | vfs/devfs |
| Confidence | speculative |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | memcorrupt |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
devfs_find_device_by_devid_worker and devfs_find_device_by_name_worker store the found cdev pointer into the reply message without reference_dev(); the documented ad-hoc contract requires callers to take a reference before further use, but the caller-side window is outside the devfs core lock. The unprivileged-reachable instance is the kern.devname sysctl (CTLFLAG_ANYBODY): after the sync reply and lock release, SYSCTL_OUT does strlen(found->si_name) — if a destroy message (e.g. unpriv-triggered clone-device churn via /dev/ptmx close) completes in that window, the read touches a terminated cdev. Unprivileged trigger but the ceiling is a stale or reused-chunk name string returned by devname(3) — objcache memory stays mapped, so no fault and no secret disclosure beyond device names; effect indistinguishable from a benign lost race. Not guest-verified (race outcome unobservable without instrumentation); reported for the lifetime-contract gap. Fix: have the worker copy si_name into the message so no post-reply dereference of the cdev occurs (or take a reference in the workers).
Timeline
- 2026-09-02 Discovered during pass-2 audit of devfs_core.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3008 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 344 B | ↓ raw | |
| VERDICT.md | — | 1.3 KB | ↓ raw | |
| df3008.c | — | 1.9 KB | view raw | |
| env.txt | — | 248 B | view raw | |
| fix.diff | — | 220 B | view raw | |
| manifest.json | — | 629 B | view raw | |
| run.log | — | 294 B | view raw | |
| verdict.json | — | 1.7 KB | view raw |
DF-3008 - devfs_find_device_by_devid/name return unreferenced cdev; kern.devname reads si_name after unlock
Severity Low | verdict: not_reproduced | impact: none
Reproduce
Sources in this directory; build with cc -O2 -o <bin> <src> -pthread on the guest.
See VERDICT.md for the full narrative and run.log for the decisive output.
DF-3008 verification
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Attempted on the guest with a 20-second dual-thread hammer (805,155 kern.devname sysctl queries against 21,740,405 ptmx clone open/close cycles). The lifetime race IS crossed constantly - 397,088 queries returned ENOENT because the queried cdev had already been destroyed - but the post-destroy si_name read never returned stale or corrupted data: every successful lookup returned a well-formed device name (ptm/N) because the objcache retains freed chunk contents. The claimed UAF-read is therefore unobservable from userspace, exactly as the original finding predicted (reported for the lifetime-contract gap, not for a demonstrable disclosure).
Kernel references
Fix
See fix.diff.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md + run.log + sources
PoC changes
adjusted from finding sketch to guest syscall/layout reality
Verified recommended fix
diff --git a/sys/vfs/devfs/devfs_core.c b/sys/vfs/devfs/devfs_core.c Copy si_name into the reply message in devfs_find_device_by_devid_worker so the sysctl never dereferences the cdev after the devfs lock is released.
Verdict
Attempted on the guest with a 20-second dual-thread hammer (805,155 kern.devname sysctl queries against 21,740,405 ptmx clone open/close cycles). The lifetime race IS crossed constantly - 397,088 queries returned ENOENT because the queried cdev had already been destroyed - but the post-destroy si_name read never returned stale or corrupted data: every successful lookup returned a well-formed device name (ptm/N) because the objcache retains freed chunk contents. The claimed UAF-read is therefore unobservable from userspace, exactly as the original finding predicted (reported for the lifetime-contract gap, not for a demonstrable disclosure).
No comments yet.