spec VOP dispatch (devfs_spec_read/write/ioctl/kqfilter, D_QUICK close) calls dev_d* on vp->v_rdev with no cdev reference and the vnode unlocked — vfs_timestamp(&node->atime) after teardown is a UAF write if the device dies during the dispatch
| Field | Value |
|---|---|
| ID | DF-3018 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H |
| CWE | CWE-667 / CWE-416 |
| File | sys/vfs/devfs/devfs_vnops.c |
| Lines | 1099-1111, 1704-1718, 1739-1755, 1775-1787, 1803-1812 |
| Area | vfs/devfs |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | memcorrupt |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
Unlike the devfs_fo_ fileops (which take reference_dev/release_dev around dev_dread/dev_dwrite/dev_dioctl/dev_dkqfilter), the VOP-layer twins cache dev=vp->v_rdev, vn_unlock(vp), dispatch, relock, then dereference the cached node (vfs_timestamp writes). devfs_freep can vget the unlocked vp, detach v_rdev and free both node and cdev mid-dispatch: driver d_ then runs on a freed cdev and the timestamp writes hit freed node memory. Unpriv reachability today is limited: direct VOP_READ/WRITE/IOCTL on device vnodes is only reachable via /dev/tty ctty forwarding, and pty destruction is gated by the pti refcount protocol, console ttys are static — no live unpriv trigger constructed. The gap bites for any driver that destroys its cdev during these dispatches (root-mediated revoke/detach, or future last-close-destroy drivers). Defense-in-depth fix matching the fo_* layer: reference_dev(dev) before vn_unlock, release_dev after relock, re-cache node after relock before vfs_timestamp; same for the D_QUICK close branch.
Timeline
- 2026-09-02 Discovered during pass-2 audit of devfs_vnops.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3018 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 302 B | ↓ raw | |
| VERDICT.md | — | 1.2 KB | ↓ raw | |
| env.txt | — | 248 B | view raw | |
| fix.diff | — | 152 B | view raw | |
| manifest.json | — | 608 B | view raw | |
| run.log | — | 156 B | view raw | |
| verdict.json | — | 1.4 KB | view raw |
DF-3018 - spec VOP dispatch calls dev_d* on vp->v_rdev with no cdev reference and vnode unlocked
Severity Low | verdict: not_reproduced | impact: none
Reproduce
No runnable PoC on this rig (see VERDICT.md for why).
See VERDICT.md for the full narrative and run.log for the decisive output.
DF-3018 verification
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Not exercised on the guest: the finding itself concludes no live unprivileged trigger exists today (direct VOP_READ/WRITE on device vnodes only reachable via ctty forwarding; pty destruction gated by the pti refcount protocol; console ttys static; root-mediated revoke/detach required). Line-verified on the audit tree: devfs_spec_read/write cache dev and node, vn_unlock(vp), dispatch dev_dread/dev_dwrite, then write vfs_timestamp(&node->atime/mtime) through the possibly-stale cached node pointer (devfs_vnops.c:1717-1755), unlike the guarded devfs_fo_* fileops. Defense-in-depth gap, not a demonstrable bug on this rig.
Kernel references
Fix
See fix.diff.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md + run.log + sources
PoC changes
none
Verified recommended fix
diff: take reference_dev/release_dev around the dev_d* dispatch in devfs_spec_read/write/ioctl/kqfilter, mirroring devfs_fo_read/write (:1275/:1333).
Verdict
Not exercised on the guest: the finding itself concludes no live unprivileged trigger exists today (direct VOP_READ/WRITE on device vnodes only reachable via ctty forwarding; pty destruction gated by the pti refcount protocol; console ttys static; root-mediated revoke/detach required). Line-verified on the audit tree: devfs_spec_read/write cache dev and node, vn_unlock(vp), dispatch dev_dread/dev_dwrite, then write vfs_timestamp(&node->atime/mtime) through the possibly-stale cached node pointer (devfs_vnops.c:1717-1755), unlike the guarded devfs_fo_* fileops. Defense-in-depth gap, not a demonstrable bug on this rig.
No comments yet.