DF-4512
vmbus: selected/registered vmbus cputimer never stopped or deregistered on detach - per-tick reload runs on the freed vmbus_softc and through unloaded module text (UAF write + dangling call target) after kldunload
Summary
vmbus_attach registers and (default-enabled) selects vmbus_cputimer_intr with .priv = sc; vmbus_detach never stops STIMER0 nor calls cputimer_intr_deregister (explicit TODOs). After unload the systimer reload path calls through unloaded text, UAF-reads cti->priv, writes timer_last (8-byte host-influenced value) into freed memory, and wrmsr's STIMER0. Root-gated admin action becomes recurring kernel corruption. Stop+refuse-while-selected+deregister fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4512 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: Hyper-V/ath hardware absent from guest
fix in finding markdown
per-fix-DF-4512
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Detach carries explicit TODOs to stop/deregister the timer but never does; cputimer_intr_deregister exists and is never called. Stop+refuse-while-selected+deregister fix.
Verdict
not_run: requires Hyper-V SynIC/SynTimer host (QEMU has none); root-gated kldunload of the live clock source
No comments yet.