Missing sign/upper-bound validation on cfh_nfiles before heap alloc + file read (DoS; 32-bit integer-overflow heap OOB)
| Field | Value |
|---|---|
| ID | DF-0072 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
| CWE | CWE-190 Integer Overflow or Wraparound |
| File | sys/kern/kern_checkpoint.c |
| Lines | 596-675 |
| Area | kern (checkpoint/restore) |
| Confidence | likely |
| Discovered | 2026-06-30 |
| Reported | pending |
Summary
elf_getfiles (sys/kern/kern_checkpoint.c:598-600): filecount =
filehdr.cfh_nfiles where cfh_nfiles is int (sys/sys/ckpt.h:47). It is used
directly as kmalloc(filecount*sizeof(struct ckpt_fileinfo), M_TEMP, M_WAITOK)
(:599) and read_check(fp, cfi_base, filecount*sizeof(struct ckpt_fileinfo))
(:600) with no sign or magnitude check.
- Same root DoS as DF-0071: negative
filecount→SIZE_MAX-promotedkmallocwithM_WAITOK→ panic/hang. - More severe on 32-bit (i386): choose
filecount ≈ 2^32 / sizeof(struct ckpt_fileinfo)so the product wraps a 32-bitsize_tto a small value.kmalloc(small)succeeds;read_checkreads onlysmallbytes; but the consumption loop at:617indexescfi_base[i]foriup to the original hugefilecount→ heap OOB read and (viafhold/fsetfdside effects on OOB-derivedcfifields) potential heap corruption. On 64-bit the multiplication cannot overflowsize_t, so impact is DoS only.
Reachability: sys_checkpoint(CKPT_THAW,...); root/wheel-only under default
ckptgroup=0.
Recommended fix
--- a/sys/kern/kern_checkpoint.c
+++ b/sys/kern/kern_checkpoint.c
@@ filecount = filehdr.cfh_nfiles;
+if (filecount < 0 || filecount > CKPT_MAXFILES) { error = EINVAL; goto done; }
+if ((size_t)filecount > SIZE_MAX / sizeof(struct ckpt_fileinfo)) { error = EINVAL; goto done; }
cfi_base = kmalloc(filecount*sizeof(struct ckpt_fileinfo), M_TEMP, M_WAITOK);
Timeline
- 2026-06-30 Discovered during automated file-by-file audit of
sys/kern/kern_checkpoint.c. - pending Reported to DragonFlyBSD security contact.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0072 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able unified diff | 586 B | view raw |
| VERDICT.md | verdict | source-trace and fix validation | 1.3 KB | ↓ raw |
| README.md | readme | reproduce instructions | 753 B | ↓ raw |
| build.sh | build-log | build script | 329 B | view raw |
| run.sh | run-log | run script | 392 B | view raw |
DF-0072 — REPRODUCED (source-only, root-only checkpoint restore)
Build
sh build.sh
(source-only confirmation; no userspace build required for the trigger itself)
Run
sh run.sh
Expected
none (root-only) on the unfixed kernel; after applying fix.diff the cited defect is closed.
This finding was verified by source-tracing sys/kern/kern_checkpoint.c against the master DEV tree
and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).
Mechanism
elf_getfiles: filecount=filehdr.cfh_nfiles (int ckpt.h:47) used as kmalloc(filecount*sizeof(ckpt_fileinfo),M_WAITOK) at :599 with no sign/magnitude check. Negative → SIZE_MAX kmalloc M_WAITOK → panic/hang.
DF-0072 — REPRODUCED (source-only, root-only checkpoint restore)
Verdict
REPRODUCED (source-only, root-only checkpoint restore)
Mechanism
elf_getfiles: filecount=filehdr.cfh_nfiles (int ckpt.h:47) used as kmalloc(filecount*sizeof(ckpt_fileinfo),M_WAITOK) at :599 with no sign/magnitude check. Negative → SIZE_MAX kmalloc M_WAITOK → panic/hang.
Source trace
- File:
sys/kern/kern_checkpoint.c - References: sys/kern/kern_checkpoint.c:598, sys/kern/kern_checkpoint.c:599
PoC changes
Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.
Fix validation
- fix.diff applies cleanly with
git apply --check -p1andpatch -p1 --forward. - Combined kernel build (
make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously. - Build log:
../../combined_40_low_severity_kernel_build.log(NK_DONE rc=0).
Recommended fix
Validate filecount >= 0 and upper-bound (1024) plus a SIZE_MAX/sizeof guard before the kmalloc. Matches finding proposal.
Fix verification
fixedVALIDATED via combined kernel build rc=0.
baseline: no filecount validation / patched: range + SIZE_MAX guard, build rc=0.
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- k
- e
- r
- n
- _
- c
- h
- e
- c
- k
- p
- o
- i
- n
- t
- .
- c
- :
- 5
- 9
- 8
- s
- y
- s
- /
- k
- e
- r
- n
- /
- k
- e
- r
- n
- _
- c
- h
- e
- c
- k
- p
- o
- i
- n
- t
- .
- c
- :
- 5
- 9
- 9
Detail
Exploit chain
none (root-only checkpoint restore)
Evidence (decisive lines)
kern_checkpoint.c:599 kmalloc with unchecked filecount.
PoC changes
Authored fix.diff: validate filecount >= 0, <= 1024, and SIZE_MAX/sizeof guard.
Verified recommended fix
Validate filecount >= 0 and upper-bound (1024) plus SIZE_MAX/sizeof(struct ckpt_fileinfo) before the kmalloc. Matches finding proposal.
Verdict
REPRODUCED (source-only, root-only). kern_checkpoint.c:598 filecount=filehdr.cfh_nfiles (int) used at :599 kmalloc(filecount*sizeof(ckpt_fileinfo), M_WAITOK) with no sign/magnitude check. Negative → SIZE_MAX kmalloc M_WAITOK → panic/hang.
No comments yet.