Kernel Stack Memory Disclosure in FreeBSD Filesystems (VOP_READDIR)

This repository contains two C proof-of-concept (PoC) exploits and a detailed README describing information disclosure vulnerabilities in the FreeBSD kernel's handling of directory entries (struct dirent) in several filesystems (msdosfs, mqueuefs, tmpfs, smbfs, autofs). The vulnerabilities allow uninitialized kernel memory, including potential kernel pointers, to be leaked to userspace via the readdir() system call. The repository structure is as follows: - README.md: Provides a thorough explanation of the vulnerability, affected filesystems, and instructions for setting up a test environment and running the PoCs. - original_poc.c: A PoC targeting msdosfs, which repeatedly opens and reads a directory, checking for non-zero values in the padding fields of struct dirent and printing leaked bytes if found. - variants_poc.c: A PoC for variant filesystems (e.g., mqueuefs), which checks for non-zero values in the d_off field of struct dirent and prints leaked kernel memory. The exploits require local access to a FreeBSD system with the relevant filesystem mounted. They demonstrate the ability to leak uninitialized kernel memory to userspace, which could be used for further exploitation (e.g., bypassing KASLR or leaking sensitive data). No network endpoints or remote attack vectors are present; the attack is purely local and filesystem-based.