β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-4463

amdtemp_detach frees dev.cpu.N.temperature oids but leaves dangling entries in the cpu devices' sysctl contexts β€” latent UAF if a cpu device is ever destroyed

Summary

sc_sysctl_cpu[] oids are allocated in the cpu device's sysctl ctx but detach removes them with sysctl_remove_oid(oid,1,0) without ctx_entry_del on the foreign ctx. Any later sysctl_ctx_free for a cpu device would walk entries pointing at freed oids. Unreachable today (pc64 cpu driver registers no detach); exactly the foot-gun kern_sysctl warns about. ctx-entry-del fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-4463 Β· 1 files
FileTypeDescriptionSize
verdict.json file 794 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

not_testable: hardware-gated / Info

fix in finding markdown
per-fix-DF-4463

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

Cross-context oid removal without sysctl_ctx_entry_del. ctx-entry-del-before-remove fix.

Verdict

not_run: latent-only, unreachable on current kernels