DF-5775 — writepid() follows symlinks and truncates the -p target with the launcher's privileges

File: sys/platform/vkernel64/platform/init.c Lines: 1388-1401 (writepid) Severity: Low (arbitrary-file truncate/overwrite via symlinked pidfile, confused-deputy against root-launched vkernels) Status: reproduced (stock) / fix validated.

Reproduce (guest, root)

cd /usr/obj/usr/src/sys/VKERNEL64
echo "DF5775-MARKER-SECRET-ORIGINAL-CONTENT-MUST-SURVIVE" > /tmp/df5775_target
ln -sf /tmp/df5775_target /tmp/df5775_link
./kernel.debug -p /tmp/df5775_link        # writepid runs before -m validation
cat /tmp/df5775_target

Expected output

Vulnerable (baseline_run.log):

before: target=DF5775-MARKER-SECRET-ORIGINAL-CONTENT-MUST-SURVIVE
after:  target=[14255]                     <- pid number only
RESULT: target CLOBBERED via symlink (vulnerable)
kernel.debug: System memory size must be specified with -m

The symlink itself survives (ls -la); the TARGET was truncated to 0 (ftruncate, init.c:1400) and overwritten with the pid string.

Fixed (fixed_run.log, rebuilt kernel with fix.diff hunk 3):

after:  target=[DF5775-MARKER-SECRET-ORIGINAL-CONTENT-MUST-SURVIVE]
RESULT: target intact (not vulnerable)
Failed to create pidfile: Too many links     <- ELOOP from O_NOFOLLOW

Root cause / threat

open(pid_file, O_RDWR|O_CREAT|O_EXLOCK|O_NONBLOCK, 0666) (init.c:1390) has no O_NOFOLLOW: a symlinked -p path is followed, then ftruncate(fd, 0) + write(fd, pid) (init.c:1400-1401) destroy and replace the target's content. Production vkernels are launched by root (rc scripts, management wrappers) and the pidfile path is exactly the kind of field that flows from configuration; a root-launched vkernel fed -p /attacker/link -> /etc/anything truncates that file to 8 bytes of pid. Classic CWE-59 pidfile clobber, in base-system infrastructure.

Note: writepid() runs before init_sys_memory() (init.c:442-444), so the clobber needs no successful boot — a vkernel that immediately errors out still truncates the target.

Fix

fix.diff hunk 3: add O_NOFOLLOW (operator who genuinely wants a symlinked pidfile can still point the link at a dedicated file created first; the error is loud: "Failed to create pidfile: Too many links").

DF-5775 — VERDICT

Status: reproduced (stock kernel, deterministic). Fix validated on a rebuilt kernel. Impact: arbitrary-file truncate/overwrite (content replaced with the pid) with the vkernel launcher's privileges — in the common root-launched deployment, root file destruction via a symlinked pidfile path. Severity Low (config-injection precondition), certain.

writepid() (init.c:1381-1404) opens the operator-supplied -p path with O_RDWR|O_CREAT|O_EXLOCK|O_NONBLOCK and no O_NOFOLLOW (init.c:1390), then ftruncate(fd, 0) (init.c:1400) and writes the pid (init.c:1401). A symlink at the pidfile path is followed: the TARGET is truncated and overwritten. Live proof on the guest (baseline_run.log):

before: target=DF5775-MARKER-SECRET-ORIGINAL-CONTENT-MUST-SURVIVE
after:  target=[14255]
RESULT: target CLOBBERED via symlink (vulnerable)

with the vkernel itself dying immediately afterwards ("System memory size must be specified with -m") — demonstrating that writepid runs BEFORE any memory/disk setup (init.c:442-444), so the clobber needs no bootable configuration at all.

Fixed kernel (fix.diff hunk 3: O_NOFOLLOW): open fails with ELOOP ("Failed to create pidfile: Too many links"), the vkernel exits, and the marker target is intact (fixed_run.log).

Reachability: -p is operator input; the security-relevant scenario is a privileged launcher consuming a pidfile path from lower-trust configuration (the same confused-deputy class as any root-run daemon with a configurable pidfile). No memory-safety primitive; hence Low.

Artifacts: run5775.sh, baseline_run.log, fixed_run.log, fix.diff.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.