DF-3185

vfs_findname() bcmp of buflen+1 bytes can read past the NUL of kernel rodata name tables (match/no-match oracle on adjacent .rodata bytes)

Summary

vfs_findname(nm, buf, buflen) compares buflen+1 bytes via bcmp (:496). vfs_getuserstr permits embedded NULs in the user-supplied string, so a write of e.g. 'attach\0X' to /proc/<pid>/ctl makes the comparison read past the terminating NUL of the rodata entry (procfs_ctl.c ctlnames[]) and into adjacent .rodata - a boolean oracle on rodata content beyond the string; mismatch returns no data. No bytes disclosed to userspace; read cannot fault; practical effect equals invoking the matched control op legitimately. FreeBSD-parity code; hardening only. Fix: bound the comparison to strlen(nm->nm_name). [VERIFIED pass2: buflen-plus-1 bcmp over-read past rodata NUL confirmed oracle-only; strlen-bounded fix compiled]

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: speculative
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE: CWE-125
File: sys/vfs/procfs/procfs_subr.c
Lines: 491-500
Area: vfs
Discovered: 2026-09-08
Updated: 2026-09-08

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-10-26 04:39:03
Attempts: 0
Runtime: 30s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: see build.sh
Run cmd: see run.sh

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-26 04:39:03
Runtime: —
Kernel: per-fix-DF-3185
fix.diff: findings/poc/DF-3185/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3185 · 4 files

File	Type	Size
README.md	—	230 B	↓ raw
fix.diff	—	512 B	view raw
manifest.json	—	322 B	view raw
verdict.json	—	1.5 KB	view raw

README.md

↓ download raw

DF-3185 evidence pack

What

vfs_findname bcmp of buflen+1 bytes reads past rodata NUL

Verdict

status=not_reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

not_testable

fix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)

↓ fix.diffper-fix-DF-3185

Confirmed kernel references

sys/vfs/procfs/procfs_subr.c:496

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a - oracle-only, no observable output

Verified recommended fix

require strlen(nm_name)==buflen and compare buflen bytes

Verdict

Line-accurate confirmation; no runtime demonstration attempted (the defect is a boolean oracle with no byte disclosure - practical effect equals invoking the control op). procfs_subr.c:496 compares buflen+1 bytes against nm->nm_name; with an embedded NUL in the /proc//ctl string (permitted by vfs_getuserstr) the bcmp reads past the rodata entrys NUL into adjacent .rodata. FreeBSD-parity code. Fix bounds the comparison to strlen(nm_name) == buflen + content equality; compiled in the F40FIX build (procfs in kernel).