OOB read of thread struct before panic in lwkt_reltoken assertion path (console-only, no userspace leak)
Summary
lwkt_reltoken (lwkt_token.c:841-854): when token stack empty (td_toks_stop==td_toks_base), ref=td_toks_stop-1 points before td_toks_array[0] into td_toks_have/td_kfpuctx (thread.h:328-331). First clause ref<&td_toks_base short-circuits correctly but kprintf (:845-846) UNCONDITIONALLY derefs ref->tr_tok/tr_count/tr_owner reading 24 bytes before array. Data only to console via kprintf, function panics immediately (:853). NO userspace info leak, NO memory corruption. Trigger requires kernel programming bug (reltoken with none held). Hardening only.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0065 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 391 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/lwkt_token.c:841: OOB read before panic in lwkt_reltoken assertion path (console-only)
Verified recommended fix
Source-confirmed at sys/kern/lwkt_token.c:841: OOB read before panic in lwkt_reltoken assertion path (console-only)
Verdict
Source-confirmed at sys/kern/lwkt_token.c:841: OOB read before panic in lwkt_reltoken assertion path (console-only)
No comments yet.