# The Taking of FreeBSD One Two Three

Three bugs in FreeBSD CTL HA mode (unauthenticated TCP port 999) give remote root: arbitrary kernel R/W, a write-only wire pointer, and an SGL heap overflow.

- Payout: Research
- Severity: critical
- Program: FreeBSD
- Write-up by: Calif
- Disclosed: 2026-08-06
- Write-up quality: 8/10
- Original: https://blog.calif.io/p/the-taking-of-freebsd-one-two-three
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three
- Tags: area:devices domain:network domain:oss impact:privesc impact:rce kind:research platform:research sev:critical tech:linux technique:source-review vuln:auth-bypass vuln:memory-corruption vuln:rce

**Target:** FreeBSD kernel CAM Target Layer (CTL) HA peer TCP port 999
**Root cause:** HA protocol embeds raw kernel pointers as message fields and trusts inbound messages without validation; DATAMOVE copies a wire-supplied SGL entry count into a fixed 64-byte heap buffer unchecked.
**Steps:**
1. Enable CTL HA (kern.cam.ctl.ha_peer set); kernel listens unauthenticated on TCP 999.
2. FreeBSD-One: send HA DATA READ/WRITE messages with raw kernel pointers; handler dereferences without validation, yielding arbitrary kernel read/write (no KASLR in GENERIC).
3. FreeBSD-Two: send DATAMOVE with attacker-controlled original_sc pointer; write-only primitive corrupts two fixed offsets, repoint a handler function pointer at DATA channel clean-write code.
4. FreeBSD-Three: send DATAMOVE with SGL entry count exceeding 64-byte buffer; overflow adjacent UMA slab object, overwrite callback function pointer, stack pivot, ROP, shellcode, clear page NX, jump.
5. Shellcode calls kproc_create and kern_execve to spawn /bin/sh and connect a root shell back to attacker.
**How found:** Prompted Claude Code (Opus 4.6) to audit remotely reachable kernel code (net, iscsi, nfs, etc.) and downstream storage/command layers; 25+ Sonnet agents over 35+ files flagged CTL HA as most dangerous: unauthenticated, remote, full of trusted pointers.
**Exploitation:** Network access to port 999 alone; no auth. FreeBSD-One uses arbitrary R/W with known symbol addresses to build code execution. FreeBSD-Two bootstraps from a dirty write-only primitive by repointing a handler to clean-write code. FreeBSD-Three grooms the UMA slab, overwrites a callback pointer, pivots stack, ROPs, clears NX, runs shellcode. All spawn root shell via kproc_create/kern_execve.
**Escalation:** Each bug independently yields root from unauthenticated network access; FreeBSD-Two chains a dirty write into a clean-write primitive to escape its constraints.
**Insight:** Storage-target HA/peer-sync protocols that embed raw kernel pointers as wire fields and assume a trusted back-channel are prime RCE surface; check whether the listen port is actually firewalled, and look for SGL entry counts copied into fixed buffers without size checks.