DF-4463
amdtemp_detach frees dev.cpu.N.temperature oids but leaves dangling entries in the cpu devices' sysctl contexts β latent UAF if a cpu device is ever destroyed
Summary
sc_sysctl_cpu[] oids are allocated in the cpu device's sysctl ctx but detach removes them with sysctl_remove_oid(oid,1,0) without ctx_entry_del on the foreign ctx. Any later sysctl_ctx_free for a cpu device would walk entries pointing at freed oids. Unreachable today (pc64 cpu driver registers no detach); exactly the foot-gun kern_sysctl warns about. ctx-entry-del fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4463 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 794 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
not_testable: hardware-gated / Info
fix in finding markdown
per-fix-DF-4463
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Cross-context oid removal without sysctl_ctx_entry_del. ctx-entry-del-before-remove fix.
Verdict
not_run: latent-only, unreachable on current kernels
No comments yet.