DF-5822 — sysctl_kern_proc uses un-held cr1 = curproc->p_ucred across blocking copyouts → ucred UAF read → visibility bypass (ps_showallprocs=0)

What

sysctl_kern_proc() caches a raw, unreferenced credential pointer:

1669:   struct ucred *cr1 = curproc->p_ucred;

and then uses it across dozens of blocking SYSCTL_OUT copyouts inside the per-process loop:

1715:   if (ps_showallprocs == 0) {
1716:       crcache = pcredcache(crcache, p);
1717:       if (crcache == NULL ||
1718:           p_trespass(cr1, crcache)) {      /* cr1 dereferenced per row */
1768:   if (!PRISON_CHECK(cr1, crcache))
1789:   if (!ps_showallthreads || jailed(cr1))

The trap layer caches td_ucred with a held reference per syscall (sys/platform/pc64/x86_64/trap.c:181-206), but that protects only the cred current at entry: any cred installed between entry and line 1669 is returned by the raw read with no reference held by this thread. When another thread of the same process then replaces credentials — cratom_proc() (sys/kern/kern_prot.c:1170-1190) installs newcr and crfree(oldcr) unconditionally on every setuid-family change — the pointed-to struct ucred is freed while cr1 keeps dereferencing it for the remainder of the (multi-millisecond, user-copy-blocked) sysctl.

p_trespass() (sys/kern/kern_prot.c:1023-1059) then reads the freed chunk; a recycled chunk (crget() zeroes on allocation, kern_prot.c:1065) reads cr_uid == 0, hitting:

1057:   if (cr1->cr_uid == 0)
1058:       return (0);      /* blanket no-trespass */

→ other users' kinfo_proc rows are emitted to a poller whose real euid is unprivileged.

Reproduced on the guest

Under security.ps_showallprocs=0 (the documented hardening config for multi-user boxes):

The churn uses setegid(0) <-> setegid(1001) (legal for the setuid-root scaffold with svgid 0) which never touches cr_uid: a fresh cr1 always has cr_uid == 1001 and can never legitimately pass p_trespass() against root-owned processes — every observed root row is therefore attributable to the stale-pointer read.

Default-config impact (ps_showallprocs=1): the p_trespass gate is skipped; remaining consumers are PRISON_CHECK/jailed() comparisons against freed memory — wrong jail visibility decisions on multi-jail hosts, no crash.

Rig

df5822_rig.c — setuid-root scaffold (mode 6755 so svgid==0 survives the euid drop): main drops to euid 1001, thread B churns setegid, thread A polls kern.proc.uid.0. Root scaffolding (one-time): sysctl -w security.ps_showallprocs=0; chown root:wheel df5822_rig; chmod 6755 df5822_rig.

Fix

-   struct ucred *cr1 = curproc->p_ucred;
+   struct ucred *cr1 = curthread->td_ucred;

(td_ucred is the trap-layer-cached, held credential — the same idiom kern_descrip.c:984/2095 already use; likewise for the two other raw caches at kern_proc.c:1878 and kern_proc.c:2038.)

Validated by kernel rebuild + re-run: bypass disappears (see VERDICT.md).

Files

df5822_rig.c, build.sh, run.sh, run.log, run.2.log, control.log, VERDICT.md, manifest.json, verdict.json, fix.diff, env.txt, build_fix.log, run_patched.log

DF-5822 VERDICT

status: reproduced / impact: visibility-bypass info disclosure (kernleak) / confidence: certain / fix validated (fixed)

Root cause (path:line)

1. sysctl_kern_proc() caches an unreferenced credential: sys/kern/kern_proc.c:1669 struct ucred *cr1 = curproc->p_ucred;
2. It dereferences cr1 per scanned row across blocking SYSCTL_OUT copyouts: kern_proc.c:1715-1721 (p_trespass(cr1, crcache) under ps_showallprocs==0), 1768 (PRISON_CHECK), 1789 (jailed(cr1)).
3. The per-syscall trap-layer credential cache (sys/platform/pc64/x86_64/trap.c:181-206) only guarantees a held reference for the cred installed at entry; a cred installed between entry and line 1669 is returned by the raw read with no reference.
4. Any other thread of the same process replacing credentials frees it: cratom_proc() sys/kern/kern_prot.c:1170-1190 (p->p_ucred = newcr; ... crfree(oldcr) — invoked by every setuid-family change, e.g. change_euid/change_egid).
5. p_trespass() sys/kern/kern_prot.c:1023-1059 dereferences the freed chunk; crget() (kern_prot.c:1065, M_ZERO) recycles chunks zeroed, so the stale read sees cr_uid == 0 and hits if (cr1->cr_uid == 0) return (0); (kern_prot.c:1057-1058) — blanket no-trespass.

The dangling cr1 persists for the whole multi-millisecond sysctl (the pointer is read once at 1669), so each poisoned call misfilters every row it scans.

Why the rows prove the UAF (not a legit euid window)

The churn is setegid(0) <-> setegid(1001), which goes through cratom_proc() but never modifies cr_uid: a fresh cr1 always has cr_uid == 1001 (ruid 1001 as well), so p_trespass(fresh, root) can never return 0 against root-owned processes. Every emitted root row under ps_showallprocs=0 is therefore attributable solely to the stale (freed/recycled) pointer read.

Baseline results (unpatched snapshot kernel, 2026-10-13)

Marker line (run.log): [rig] CHURN iter 632204: 1 ROOT rows visible with euid=1001 <== STALE cr1 BYPASS.

Fix validation (same guest, rebuilt kernel)

• fix.diff applied to the guest's /usr/src (all 3 sites: kern_proc.c 1669/1878/2038 cr1 = curthread->td_ucred), make nativekernel KERNCONF=X86_64_GENERIC + installkernel, reboot into #1: Tue Oct 13 06:36:10 UTC 2026.
• Same rig, same scaffold, same ps_showallprocs=0:
• patched run 1: 922,345 poll iterations → 0 bypass, 0 root rows
• patched run 2: 894,484 poll iterations → 0 bypass, 0 root rows (run_patched.log)
• Baseline vs patched: 60k-78k bypass iterations per ~25-30 s → zero. The visibility bypass is gone; churn rate and poll rate unchanged (poll iterations actually higher — no row copies happening).

Impact / severity reasoning

• Under security.ps_showallprocs=0 (the documented hardening used on shared multi-user machines): full kinfo_proc rows (argv-adjacent metadata, rusage, tty, exit status) of every other uid — including root — disclosed to an unprivileged poller, ~12% of polls. Info leak, no crash, no memory-content disclosure beyond the row data.
• Default config (ps_showallprocs=1): the p_trespass gate is skipped; remaining uses of the stale pointer are PRISON_CHECK (1768) and jailed() (1789) — on multi-jail hosts these can mis-judge prison visibility from freed memory; no crash observed or expected (M_CRED zone-resident).
• UAF read only; no write primitive; no uid change. Severity: Medium.

Reproduce

# one-time root scaffolding
cc -O2 -pthread -o df5822_rig df5822_rig.c
chown root:wheel df5822_rig && chmod 6755 df5822_rig
sysctl -w security.ps_showallprocs=0
# unprivileged
./df5822_rig 25
# unpatched: "[rig] CHURN ... <== STALE cr1 BYPASS" + "root rows observed: NNNNN"
# patched:   "root rows observed   : 0"

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.