Section-header index not bounds-checked against e_shnum in link_elf_obj_load_file (heap OOB read)
| Field | Value |
|---|---|
| ID | DF-0040 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H |
| CWE | CWE-125 Out-of-bounds Read |
| File | sys/kern/link_elf_obj.c |
| Lines | 551 (symstrindex off-by-one), 603-604 (e_shstrndx) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-06-29 |
| Reported | pending |
Summary
link_elf_obj_load_file indexes shdr[] with two attacker-controlled indices
without a correct < e_shnum guard: :551 uses symstrindex > e_shnum
instead of >= (so a crafted sh_link == e_shnum reads shdr[e_shnum], one
past the array), and :603-604 indexes shdr[e_shstrndx] with no
e_shstrndx < e_shnum check (so an e_shstrndx up to 65535 reads far past the
allocation). Both are heap OOB reads of attacker-influenced extent. The preload
path link_elf_obj_preload_file uses the correct >= form (:245-248),
confirming the load_file checks are regressions.
Root cause
if (symstrindex < 0 || symstrindex > hdr->e_shnum || /* should be >= */
shdr[symstrindex].sh_type != SHT_STRTAB) {
sys/kern/link_elf_obj.c:603-604:
if (hdr->e_shstrndx != 0 &&
shdr[hdr->e_shstrndx].sh_type == SHT_STRTAB) { /* no < e_shnum check */
shdr is kmalloc(e_shnum*sizeof(Elf_Shdr)) (:503). Correct bounds are in
link_elf_obj_preload_file (:245-248, uses >=).
Threat model & preconditions
- Attacker position: root via
kldload(2)(SYSCAP_NOKLD, securelevel 0); ELF bytes fully attacker-controlled. Root already owns the kernel (a valid.ko'sSYSINITruns in kernel context), so this grants no new privilege — it is robustness/defense-in-depth (matters for verified-boot / securelevel / restricted-module scenarios and clean panic-free parsing). - Privileges gained or impact: heap OOB read of
M_LINKERmemory; panic if it crosses into unmapped pages (local DoS), or attacker-influencedsh_type/sh_size/sh_offsetvalues then drivekmalloc/vn_rdwr. - Reachability:
kldload(2)of a crafted.kowithsh_link == e_shnumand/ore_shstrndx >= e_shnum.
Recommended fix
--- a/sys/kern/link_elf_obj.c
+++ b/sys/kern/link_elf_obj.c
@@ -551
- if (symstrindex < 0 || symstrindex > hdr->e_shnum ||
+ if (symstrindex < 0 || symstrindex >= hdr->e_shnum ||
@@ -603
if (hdr->e_shstrndx != 0 &&
+ hdr->e_shstrndx < hdr->e_shnum &&
shdr[hdr->e_shstrndx].sh_type == SHT_STRTAB) {
References
sys/kern/link_elf_obj.c:551,603-604— the unchecked indices.sys/kern/link_elf_obj.c:245-248— preload's correct>=bounds.- CWE-125 Out-of-bounds Read.
Timeline
- 2026-06-29 Discovered during automated file-by-file audit of
sys/kern/link_elf_obj.c. - pending Reported to DragonFlyBSD security contact.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0040 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able unified diff | 725 B | view raw |
| VERDICT.md | verdict | source-trace and fix validation | 1.2 KB | ↓ raw |
| README.md | readme | reproduce instructions | 683 B | ↓ raw |
| build.sh | build-log | build script | 329 B | view raw |
| run.sh | run-log | run script | 392 B | view raw |
DF-0040 — REPRODUCED (source-only, root-only kldload)
Build
sh build.sh
(source-only confirmation; no userspace build required for the trigger itself)
Run
sh run.sh
Expected
none (root-only) on the unfixed kernel; after applying fix.diff the cited defect is closed.
This finding was verified by source-tracing sys/kern/link_elf_obj.c against the master DEV tree
and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).
Mechanism
symstrindex > hdr->e_shnum at :551 should be >= (off-by-one); shdr[hdr->e_shstrndx] at :603-604 indexed with NO < e_shnum check (e_shstrndx up to 65535).
DF-0040 — REPRODUCED (source-only, root-only kldload)
Verdict
REPRODUCED (source-only, root-only kldload)
Mechanism
symstrindex > hdr->e_shnum at :551 should be >= (off-by-one); shdr[hdr->e_shstrndx] at :603-604 indexed with NO < e_shnum check (e_shstrndx up to 65535).
Source trace
- File:
sys/kern/link_elf_obj.c - References: sys/kern/link_elf_obj.c:551, sys/kern/link_elf_obj.c:603
PoC changes
Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.
Fix validation
- fix.diff applies cleanly with
git apply --check -p1andpatch -p1 --forward. - Combined kernel build (
make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously. - Build log:
../../combined_40_low_severity_kernel_build.log(NK_DONE rc=0).
Recommended fix
Change > to >= at :551 and add hdr->e_shstrndx < hdr->e_shnum at :603. Matches finding proposal.
Fix verification
fixedVALIDATED via combined kernel build rc=0.
baseline: off-by-one + missing bounds check / patched: >= + < e_shnum, build rc=0.
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- l
- i
- n
- k
- _
- e
- l
- f
- _
- o
- b
- j
- .
- c
- :
- 5
- 5
- 1
- s
- y
- s
- /
- k
- e
- r
- n
- /
- l
- i
- n
- k
- _
- e
- l
- f
- _
- o
- b
- j
- .
- c
- :
- 6
- 0
- 3
Detail
Exploit chain
none (root-only kldload; root already owns kernel)
Evidence (decisive lines)
link_elf_obj.c:551 uses > instead of >=; :603 has no < e_shnum check.
PoC changes
Authored fix.diff: change > to >= at :551, add e_shstrndx<e_shnum at :603.
Verified recommended fix
Tighten bounds: symstrindex >= e_shnum at :551; hdr->e_shstrndx < hdr->e_shnum at :603. Matches finding proposal.
Verdict
REPRODUCED (source-only, root-only kldload). link_elf_obj.c:551 has off-by-one symstrindex > e_shnum should be >=; :603-604 indexes shdr[e_shstrndx] with no upper bound check. Crafted ELF section header indices OOB the shdr[] array.
No comments yet.