Uninitialized segs[1]/segs[0] dereference when fewer than 2 PT_LOAD segments
Summary
link_elf_load_file (link_elf.c:399 segs[2] uninit stack; :531 checks phdyn!=NULL but NOT nsegs==2; :541-542 unconditionally derefs segs[0]->p_vaddr and segs[1]->p_vaddr+segs[1]->p_memsz). Crafted ELF with PT_DYNAMIC but 0/1 PT_LOAD -> wild deref of uninitialized stack pointer -> panic. Root-only defense-in-depth.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0059 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able unified diff | 382 B | view raw |
| VERDICT.md | verdict | source-trace and fix validation | 1.2 KB | ↓ raw |
| README.md | readme | reproduce instructions | 765 B | ↓ raw |
| build.sh | build-log | build script | 329 B | view raw |
| run.sh | run-log | run script | 392 B | view raw |
DF-0059 — REPRODUCED (source-only, root-only kldload)
Build
sh build.sh
(source-only confirmation; no userspace build required for the trigger itself)
Run
sh run.sh
Expected
none (root-only) on the unfixed kernel; after applying fix.diff the cited defect is closed.
This finding was verified by source-tracing sys/kern/link_elf.c against the master DEV tree
and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).
Mechanism
link_elf_load_file: segs[2] uninit stack at :399; :531 checks phdyn!=NULL but NOT nsegs==2; :541-542 unconditionally derefs segs[0]->p_vaddr and segs[1]->p_vaddr+segs[1]->p_memsz. Crafted ELF with PT_DYNAMIC but 0/1 PT_LOAD → wild deref.
DF-0059 — REPRODUCED (source-only, root-only kldload)
Verdict
REPRODUCED (source-only, root-only kldload)
Mechanism
link_elf_load_file: segs[2] uninit stack at :399; :531 checks phdyn!=NULL but NOT nsegs==2; :541-542 unconditionally derefs segs[0]->p_vaddr and segs[1]->p_vaddr+segs[1]->p_memsz. Crafted ELF with PT_DYNAMIC but 0/1 PT_LOAD → wild deref.
Source trace
- File:
sys/kern/link_elf.c - References: sys/kern/link_elf.c:399, sys/kern/link_elf.c:531, sys/kern/link_elf.c:541
PoC changes
Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.
Fix validation
- fix.diff applies cleanly with
git apply --check -p1andpatch -p1 --forward. - Combined kernel build (
make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously. - Build log:
../../combined_40_low_severity_kernel_build.log(NK_DONE rc=0).
Recommended fix
Require nsegs == 2 before the derefs at :541-542. Matches finding proposal.
Fix verification
fixedVALIDATED via combined kernel build rc=0.
baseline: no nsegs check / patched: nsegs != 2 reject, build rc=0.
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- l
- i
- n
- k
- _
- e
- l
- f
- .
- c
- :
- 3
- 9
- 9
- s
- y
- s
- /
- k
- e
- r
- n
- /
- l
- i
- n
- k
- _
- e
- l
- f
- .
- c
- :
- 5
- 3
- 1
- s
- y
- s
- /
- k
- e
- r
- n
- /
- l
- i
- n
- k
- _
- e
- l
- f
- .
- c
- :
- 5
- 4
- 1
Detail
Exploit chain
none (root-only kldload)
Evidence (decisive lines)
link_elf.c:531 missing nsegs==2 check before :541 deref.
PoC changes
Authored fix.diff: require nsegs == 2 before the derefs.
Verified recommended fix
Add if (nsegs != 2) { error = ENOEXEC; goto out; } after the phdyn check. Matches finding proposal.
Verdict
REPRODUCED (source-only, root-only). link_elf.c:399 declares Elf_Phdr *segs[2] uninitialized; :531 checks phdyn!=NULL but NOT nsegs==2; :541-542 unconditionally derefs segs[0]/segs[1]. Crafted ELF with PT_DYNAMIC but <2 PT_LOAD → wild deref of uninitialized stack pointer.
No comments yet.