kern/60492: hdaudio(4): setconfig is allowed unprivileged

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60492
>Category:       kern
>Synopsis:       hdaudio(4): setconfig is allowed unprivileged
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 23 21:45:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The NetBSD Foundaudio, Inconfigured
>Environment:
>Description:

	The ioctl(HDAUDIO_FGRP_SETCONFIG) command is available to
	anyone with any access -- including read-only -- to
	/dev/hdaudioN with no write access checks.

	This can be used to trigger config_detach / config_found, and
	if there are any races in those (which is often the case),
	might be exploitable for local privilege escalation.

	Forwarded to us by Khushali Dalal <kdalal%vulncheck.com@localhost>.

>How-To-Repeat:

	1. Build hdaudioctl(8) so that it opens /dev/hdaudioN O_RDONLY
	   instead of O_RDWR.

	2. hdaudioctl set ...

>Fix:

	Add access checks to hdaudioioctl.