DF-4441

init_device kprintf leaks kernel heap pointer (COREBUF %p) to console — readable by unprivileged users via dmesg (security.unprivileged_read_msgbuf=1 default)

Summary

kprintf('COREBUF %p...') at attach prints a live M_DEVBUF heap address to the msgbuf, which unprivileged users can read by default (verified =1 on guest). Heap-layout disclosure aiding slab grooming. Delete-the-debug-print fix.

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Privilege escalation (general use)
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE: CWE-200
File: sys/dev/smbus/atmel_mxt/atmel_mxt.c
Lines: 393
Area: dev
Discovered: 2026-09-20
Updated: 2026-09-20

Team triage

untriaged

priority: — · owner: —

PoC verification

untested

Status: untested
Reproduced: no
Impact: Kernel heap pointer disclosed to dmesg, readable unprivileged (security.unprivileged_read_msgbuf=1 default on guest)
Confidence: certain
Tested: 2026-09-20 05:21:05
Attempts: 0
Runtime: —
Code hash: —
Guest: —
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: no
Patched reproduced: no
Confidence: certain
Tested: 2026-09-20 05:21:05
Runtime: —
Kernel: per-fix-DF-4441
fix.diff: findings/poc/DF-4441/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4441 · 1 files

File	Type	Description	Size
verdict.json	file		735 B	view raw

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

not_testable: no atmel i2c device on guest

fix in finding markdown

per-fix-DF-4441

Confirmed kernel references

sys/dev/smbus/atmel_mxt/atmel_mxt.c:393

Detail

Exploit chain

[]

Evidence (decisive lines)

kprintf COREBUF %p at attach. Delete-the-debug-print fix in finding markdown.

Verdict

not_run: no atmel device on guest