DF-0063 — REPRODUCED (source-only, root-only kldload)

Build

sh build.sh

(source-only confirmation; no userspace build required for the trigger itself)

Run

sh run.sh

Expected

none (root-only) on the unfixed kernel; after applying fix.diff the cited defect is closed. This finding was verified by source-tracing sys/kern/link_elf.c against the master DEV tree and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).

Mechanism

link_elf_lookup_symbol: while(symnum!=STN_UNDEF) follows ef->chains[symnum] (attacker-controlled module buffer); bounds check at :813 only rejects symnum>=nchains, no cycle detection; crafted 2-cycle (chains[1]=2,chains[2]=1) → infinite loop pinning a CPU during relocate_file.

DF-0063 — REPRODUCED (source-only, root-only kldload)

Verdict

REPRODUCED (source-only, root-only kldload)

Mechanism

link_elf_lookup_symbol: while(symnum!=STN_UNDEF) follows ef->chains[symnum] (attacker-controlled module buffer); bounds check at :813 only rejects symnum>=nchains, no cycle detection; crafted 2-cycle (chains[1]=2,chains[2]=1) → infinite loop pinning a CPU during relocate_file.

Source trace

• File: sys/kern/link_elf.c
• References: sys/kern/link_elf.c:812, sys/kern/link_elf.c:838

PoC changes

Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.

Fix validation

• fix.diff applies cleanly with git apply --check -p1 and patch -p1 --forward.
• Combined kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously.
• Build log: ../../combined_40_low_severity_kernel_build.log (NK_DONE rc=0).

Recommended fix

Cap iterations at nchains (a valid chain visits each symbol at most once). Matches finding proposal.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.