DF-5427 — signed/unsigned index confusion in VIDIOC_ENUM_FRAMEINTERVALS → kernel heap OOB read (info leak + panic DoS)

Where

• Entry (unprivileged, /dev/videoN is 0666, no pri required): sys/bus/u4b/uvc/uvc_v4l2.c:562-566 — VIDIOC_ENUM_FRAMEINTERVALS dispatch passes the user struct v4l2_frmivalenum * straight through.
• Root cause / sink: sys/bus/u4b/uvc/uvc_drv.c:750 (int index = itv->index; — __u32 user value into signed int), :756 (if (index < nintervals) — passes trivially when negative), :768 (frm->interval[index].val — OOB read at attacker-chosen negative word offset, value then copied back out by the _IOWR ioctl).
• Allocation walked off: uvc_drv.c:1726-1731 — one slab [fmt array | frm array | interval slab]; the read walks backward through the slab and past its start into adjacent kernel heap.

Attack model

Any local user (the cdev is crw-rw-rw- root video) on a machine with a UVC webcam issues ioctl(fd, VIDIOC_ENUM_FRAMEINTERVALS, {.index = 0xFFFFFFFF - (k-1), .pixel_format = <known fcc>, .width/w height = <known frame>}). index >= 0x80000000 turns into a negative int, the bounds check is satisfied, and frm->interval[index].val reads 4 bytes of kernel heap at interval - 4k. The value is transformed by uvc_simple_frac() (continued fraction of val/10^7 — effectively value-preserving to ~1e7/den²) and copied to userspace. With index = 0x80000000 (−8 GiB) the load hits an unmapped address and panics the kernel.

Build / run (as verified)

./build.sh                  # KLD harness that #includes the REAL uvc sources
                            # + unpriv trigger
# on guest:  kldload /root/build/uvcharness.ko   (round 1 + /dev/video97)
run.sh                      # 3 groom rounds + unpriv trigger (root ctx)
# as unpriv user:
/tmp/trig                   # leak proof (k=1 deterministic MATCH, k=33+ heap)
/tmp/trig --panic           # guest dies: Fatal trap 12

Expected (baseline, verified 2026-10-04)

• TRIGGER k=1 ... expected num/den=22203/7058 got num/den=22203/7058 -> MATCH (interval[-1] = frm tail = width|height<<16 = 0x01e00280)
• k=2..8 disclose frame/format fields incl. kernel pointer halves (k=7 → ≈0xFFFFF800, k=8 → ≈0x8d641xxx)
• k=33+ (outside the 144-byte slab): groom markers 0x5A5A5A5A / 0xA7A7A7A7 and stale freed-slab interval values across rounds
• --panic: Fatal user address access from kernel mode from trig, fault virtual address = 0xfffff7fe4f1e9950 (= interval − 8 GiB), Stopped at uvc_drv_enum_v4l2_frameintervals+0x18b: movl (%rax,%r10,4),%eax (panic.txt; process trig runs as uid=1001)

After fix.diff (applied to guest /usr/src, harness rebuilt)

• every negative index → EINVAL, no value copied out (fix.log)
• in-bounds index=0 still returns 1/30 (no regression)
• --panic attempt → EINVAL, guest stays up (vm.sh status: up)

Files

uvcharness.c   KLD harness (real driver sources compiled in, real
               uvc_v4l2_reg() cdev, groom + ground-truth dump)
trigger.c      unprivileged userland trigger (self-contained v4l2 defs
               + mirror of uvc_simple_frac for value prediction)
build.sh/run.sh/run_panic.sh, Makefile
build.log run.log run_user.log leak_sample.txt dmesg.txt panic.txt env.txt
fix.diff       unsigned-index fix (validated)
fix_build.log fix_boot.log fix.log

DF-5427 — VERDICT

Status: reproduced (unprivileged leak + unprivileged panic). Impact: leak (kernel heap disclosure, attacker-controlled negative offset) + panic (local DoS). Confidence: certain.

Reproduction narrative

1. Static proof. uvc_v4l2.c:562-566 dispatches VIDIOC_ENUM_FRAMEINTERVALS with zero validation of itv->index (this ioctl is not even priority-gated, uvc_v4l2.c:469-490). uvc_drv.c:750 copies the __u32 user index into a signed int; uvc_drv.c:756's index < nintervals accepts every negative value; uvc_drv.c:768 then loads frm->interval[index].val — a plain movl (%rax,%r10,4),%eax (confirmed in the panic backtrace) at interval + 4*index, i.e. up to 8 GiB below the interval array. The slab holding the array is the single kmalloc at uvc_drv.c:1726-1731 ([fmt|frm|interval], 144 bytes for the harness camera), so anything from index = -33 on reads other heap objects below the allocation.

2. Rig. uvcharness.c compiles the production uvc sources into a KLD, parses a benign YUY2/640x480/4-discrete-interval config exactly as a real webcam does (uvc_drv_init_ctrl + uvc_drv_parse_ctrl), and calls the production uvc_v4l2_reg() (uvc_v4l2.c:771-799) which does the real make_dev(..., 0666, "video97"). Before each parse it grooms same-size heap chunks with a per-round marker (0x5A/0xA7/0xC3) so the memory below the slab is identifiable, and dumps the kernel-side ground truth of interval[-i], i=1..60.

3. Unprivileged leak (run_user.log, uid=1001). * Ground truth (dmesg.txt/panic.txt): interval[-1] = 0x01e00280 (= width | height<<16), [-2] = 0x00096000 (max_buffer_size), [-3] = 0x00051615 (default_interval), markers 5a5a5a5a at [-33].. in the marker rounds, kernel pointers (fffff800 8d6416d0) at [-7]/[-8]. * Userland: index=0x80000000|... → wait, small negatives are (uint32_t)-k; TRIGGER k=1 expected num/den=22203/7058 got 22203/7058 -> MATCH — the unpriv process received exactly the CF-transformed value of the 4 bytes at interval[-1], predicted by a userland mirror of uvc_simple_frac(). k=2 → ≈614406.8 (=0x96000), k=3 → 333333.3, k=4/5 → ≈3109919.6 (=0x2f7400 dMinBitRate), k=7 → 4290000000 (≈0xfffff800, kernel pointer high half), k=8 varies per round (≈0x8d641xxx, heap address). * Outside the allocation (k=33+): round 1 disclosed the marker 0x5A5A5A5A (=1515870810, received as 1515870967.7 ≈ CF rounding), round 2 the marker 0xA7A7A7A7 (2812782695 → 2812782503.0), round 3 stale interval values (1000000/666666/400000/333333) of a previously-freed slab — kernel heap contents below the allocation, varying with heap state, disclosed to uid=1001 across 3 runs (leak_sample.txt). * The value passes through uvc_simple_frac() (a continued-fraction reduction of val/10^7): deterministic and effectively value-preserving to ≈10^7/den², so pointer-sized material is recoverable to ~unit precision (k=1 MATCH proves the transform is exactly invertible-predictable).

4. Unprivileged panic (panic.txt). run_user '/tmp/trig --panic' with index = 0x80000000 (INT_MIN ⇒ read at interval − 8 GiB): Fatal user address access from kernel mode from trig Fatal trap 12: page fault while in kernel mode fault virtual address = 0xfffff7fe4f1e9950 (= 0xfffff8004f1e9950 - 8GiB) Stopped at uvc_drv_enum_v4l2_frameintervals+0x18b: movl (%rax,%r10,4),%eax Guest down (ssh hung, vm.sh status ⇒ down), triggered by the uid=1001 process trig.

5. Fix validation (fix.log, fix_build.log, fix_boot.log). fix.diff makes index uint32_t and compares in unsigned arithmetic. Applied to the guest's /usr/src, harness rebuilt against the patched tree: * every negative index → EINVAL ("Invalid argument"), nothing copied out — also the kernel-side sanity call now returns ret=22 with num=0 den=0; * in-bounds index=0 → still 1/30 (no functional regression); * --panic → EINVAL, guest stays up (vm.sh status: up). Guest was then vm.sh reset with-src back to clean state.

Why not uid0

This is a pure OOB read of 4-byte units at controlled negative offsets with a CF-transformed copyout. It is a high-quality heap-disclosure primitive (offset fully controlled, repeatable, no crash for near offsets) — ideal for heap-layout/KASLR-adjacent recon in a chain, but no write primitive exists on this path, so local root is not reachable from this bug alone. (Guest has no KASLR; the leak is still the real primitive.)

Attempts

3 (1: Werror truncation build fix; 2: harness sanity call used 0x80000001 = INT_MIN+2 instead of -1 → accidental kernel-context panic that pre-confirmed the fault address/instruction; 3: corrected indices → full unpriv leak + unpriv panic + fix validation).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.