Truncated prison-id sysctl node name in prison_sysctl_create (off-by-one in ksnprintf size)
| Field | Value |
|---|---|
| ID | DF-0054 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CWE | CWE-193 Off-by-one Error |
| File | sys/kern/kern_jail.c |
| Lines | 993-994 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-06-29 |
| Reported | pending |
Summary
prison_sysctl_create() declares char id_str[7] (correctly sized: JAIL_MAX
= 999999 ⇒ up to 6 digits + NUL) but calls ksnprintf(id_str, 6, "%d",
pr->pr_id) — the size should be sizeof(id_str) (7), not 6. With size=6,
ksnprintf writes at most 5 chars + NUL, truncating every 6-digit pr_id
(100000–999998, half of the legal range) to its leading 5 digits. The resulting
per-prison sysctl node name (_jail.<id>) collides: ids 100000–100009 all map
to "10000", etc., so jail-management tools addressing a prison via
sysctl kern.jail.<id>.* silently target the wrong prison (or fail on the
duplicate name).
Root cause
char id_str[7];
ksnprintf(id_str, 6, "%d", pr->pr_id); /* size=6 should be sizeof(id_str)=7 */
Recommended fix
--- a/sys/kern/kern_jail.c
+++ b/sys/kern/kern_jail.c
@@ -993
- ksnprintf(id_str, 6, "%d", pr->pr_id);
+ ksnprintf(id_str, sizeof(id_str), "%d", pr->pr_id);
References
sys/kern/kern_jail.c:993-994— the off-by-one size.- CWE-193 Off-by-one Error.
Timeline
- 2026-06-29 Discovered during automated file-by-file audit of
sys/kern/kern_jail.c. - pending Reported to DragonFlyBSD security contact.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0054 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able unified diff | 374 B | view raw |
| VERDICT.md | verdict | source-trace and fix validation | 1.2 KB | ↓ raw |
| README.md | readme | reproduce instructions | 758 B | ↓ raw |
| build.sh | build-log | build script | 329 B | view raw |
| run.sh | run-log | run script | 392 B | view raw |
DF-0054 — REPRODUCED (source-only)
Build
sh build.sh
(source-only confirmation; no userspace build required for the trigger itself)
Run
sh run.sh
Expected
none (sysctl naming) on the unfixed kernel; after applying fix.diff the cited defect is closed.
This finding was verified by source-tracing sys/kern/kern_jail.c against the master DEV tree
and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).
Mechanism
prison_sysctl_create declares char id_str[7] (correct for JAIL_MAX=999999 6 digits+NUL) but ksnprintf(id_str,6,...) uses size=6 instead of sizeof=7 → truncates 6-digit pr_ids (100000-999998) to 5 digits → _jail.
DF-0054 — REPRODUCED (source-only)
Verdict
REPRODUCED (source-only)
Mechanism
prison_sysctl_create declares char id_str[7] (correct for JAIL_MAX=999999 6 digits+NUL) but ksnprintf(id_str,6,...) uses size=6 instead of sizeof=7 → truncates 6-digit pr_ids (100000-999998) to 5 digits → _jail.
Source trace
- File:
sys/kern/kern_jail.c - References: sys/kern/kern_jail.c:993, sys/kern/kern_jail.c:994
PoC changes
Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.
Fix validation
- fix.diff applies cleanly with
git apply --check -p1andpatch -p1 --forward. - Combined kernel build (
make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously. - Build log:
../../combined_40_low_severity_kernel_build.log(NK_DONE rc=0).
Recommended fix
Use sizeof(id_str) instead of hardcoded 6. Matches finding proposal.
Fix verification
fixedVALIDATED via combined kernel build rc=0.
baseline: ksnprintf size=6 / patched: sizeof(id_str)=7, build rc=0.
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- k
- e
- r
- n
- _
- j
- a
- i
- l
- .
- c
- :
- 9
- 9
- 3
- s
- y
- s
- /
- k
- e
- r
- n
- /
- k
- e
- r
- n
- _
- j
- a
- i
- l
- .
- c
- :
- 9
- 9
- 4
Detail
Exploit chain
none (sysctl node naming)
Evidence (decisive lines)
kern_jail.c:994 hardcodes size 6 vs buffer 7.
PoC changes
Authored fix.diff: use sizeof(id_str) instead of hardcoded 6.
Verified recommended fix
Use sizeof(id_str) instead of 6 in ksnprintf. Matches finding proposal.
Verdict
REPRODUCED (source-only). kern_jail.c:992 declares char id_str[7] (correct for 6-digit pr_id+NUL) but :994 ksnprintf(id_str,6,...) hardcodes size 6 instead of sizeof=7 → truncates 6-digit pr_ids (100000-999998) to 5 digits, breaking the _jail.
No comments yet.