# FreeBSD copyin fault handler leaves SMAP disabled

FreeBSD 12 copyin/copyout fault handler fails to clear RFLAGS.AC, leaving SMAP disabled in kernel after a faulting syscall, easing exploitation.

- Payout: hidden
- Severity: medium
- Program: PlayStation
- Found by: m00nbsd
- Disclosed: 2021-05-27
- CVE: CVE-2021-29628
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1048322
- Library page: https://bugbountylibrary.com/r/h1%3A1048322
- Tags: area:oss domain:oss impact:privesc kind:bounty platform:hackerone sev:medium tech:linux technique:source-review vuln:memory-corruption vuln:privilege-escalation

**Target:** FreeBSD kernel copyin/copyout fault path on PS5
**Root cause:** The copy_fault handler registered in pcb_onfault returns without executing clac, so RFLAGS.AC stays set after a faulting copyin/copyout, leaving SMAP disabled for the rest of the syscall.
**Steps:**
1. Trigger a syscall that calls copyin()/copyout() with an unmapped user address to force a fault
2. trap() sees pcb_onfault set and IRETs to copy_fault
3. copy_fault returns EFAULT without clac, so RFLAGS.AC remains set
4. Rest of syscall runs with SMAP disabled; state survives context switches if rescheduling occurs
**How found:** Code review of FreeBSD copyin/copyout assembly and trap() fault handling; noticed copy_fault lacks clac while the normal path clears RFLAGS.AC.
**Exploitation:** Userland forces a faulting copyin/copyout to leave SMAP disabled across kernel execution, opening large windows where kernel can access user pages, making common kernel vulns trivial to exploit.
**Escalation:** SMAP disablement survives context switches, so a rescheduling during the syscall can disable SMAP in other threads.
**Insight:** Audit fault-recovery paths (pcb_onfault handlers) for missing restoration of CPU state like RFLAGS.AC; the normal path's clac doesn't cover the fault exit.