pps_shift/pps_shiftmax sysctl lack range validation allowing UB shift counts in hardpps (root self-DoS)
Summary
kern_ntptime.c:265-266 pps_shiftmax/pps_shift CTLFLAG_RW SYSCTL_INT bypass MOD_PPSMAX clamp (:338-345) that ntp_adjtime API enforces. Root can set >=32 or negative -> hardpps 1<<pps_shift (:787/:806) MAXFREQ<<pps_shift (:804) L_RSHIFT(ftemp,pps_shift) (:824) = UB (C11 6.5.7). Requires PPS_SYNC kernel + root sysctl write + active PPS driver. Impact: corrupted freq-discipline state / timekeeping malfunction (self-DoS). No memcor primitive (results bounded by subsequent range checks :805-810).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0078 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | pps_shift/pps_shiftmax sysctl lack range validation allowing UB shift counts in | 733 B | view raw |
Fix verification
fixedfix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_ntptime.c:265: pps_shift sysctls lack range validation (UB shift, root self-DoS)
Verified recommended fix
Source-confirmed at sys/kern/kern_ntptime.c:265: pps_shift sysctls lack range validation (UB shift, root self-DoS)
Verdict
Source-confirmed at sys/kern/kern_ntptime.c:265: pps_shift sysctls lack range validation (UB shift, root self-DoS)
No comments yet.