Off-by-one OOB read in get_next_valid_apicid: array indexed before bound check in while condition
| Field | Value |
|---|---|
| ID | DF-0084 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CWE | CWE-125 Out-of-bounds Read |
| File | sys/kern/subr_cpu_topology.c |
| Lines | 91-105 |
| Area | kern (CPU topology / boot) |
| Confidence | likely |
| Discovered | 2026-06-30 |
| Reported | pending |
Summary
In get_next_valid_apicid(), the do/while condition is:
while (get_cpuid_from_apicid(next_apicid) == -1 &&
next_apicid < NAPICID); /* sys/kern/subr_cpu_topology.c:98-99 */
The array-indexing macro get_cpuid_from_apicid() is evaluated before the
bound check. When next_apicid reaches NAPICID (256), the macro expands to
apic_id_to_cpu_id[NAPICID] — one element past the end of the
int apic_id_to_cpu_id[NAPICID] array (lapic.c:122-123) — before the &&
short-circuits on next_apicid < NAPICID being false. The bogus value is
discarded (the function returns -1 at :100-103), so impact is a single 4-byte
OOB read of adjacent BSS with no control over its use.
Recommended fix
Reorder the condition to short-circuit on the bound first:
--- a/sys/kern/subr_cpu_topology.c
+++ b/sys/kern/subr_cpu_topology.c
- while(get_cpuid_from_apicid(next_apicid) == -1 &&
- next_apicid < NAPICID);
+ while(next_apicid < NAPICID &&
+ get_cpuid_from_apicid(next_apicid) == -1);
Timeline
- 2026-06-30 Discovered during automated file-by-file audit of
sys/kern/subr_cpu_topology.c. - pending Reported to DragonFlyBSD security contact.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0084 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able unified diff | 501 B | view raw |
| VERDICT.md | verdict | source-trace and fix validation | 1.3 KB | ↓ raw |
| README.md | readme | reproduce instructions | 847 B | ↓ raw |
| build.sh | build-log | build script | 329 B | view raw |
| run.sh | run-log | run script | 392 B | view raw |
DF-0084 — REPRODUCED (source-only, boot-time only)
Build
sh build.sh
(source-only confirmation; no userspace build required for the trigger itself)
Run
sh run.sh
Expected
none (boot-time) on the unfixed kernel; after applying fix.diff the cited defect is closed.
This finding was verified by source-tracing sys/kern/subr_cpu_topology.c against the master DEV tree
and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).
Mechanism
get_next_valid_apicid at :98-99: while(get_cpuid_from_apicid(next_apicid)==-1 && next_apicid<NAPICID) evaluates the array-indexing macro get_cpuid_from_apicid BEFORE the bound check. When next_apicid reaches NAPICID(256), get_cpuid_from_apicid reads apic_id_to_cpuid[256] (OOB by one) before the bound check aborts.
DF-0084 — REPRODUCED (source-only, boot-time only)
Verdict
REPRODUCED (source-only, boot-time only)
Mechanism
get_next_valid_apicid at :98-99: while(get_cpuid_from_apicid(next_apicid)==-1 && next_apicid<NAPICID) evaluates the array-indexing macro get_cpuid_from_apicid BEFORE the bound check. When next_apicid reaches NAPICID(256), get_cpuid_from_apicid reads apic_id_to_cpuid[256] (OOB by one) before the bound check aborts.
Source trace
- File:
sys/kern/subr_cpu_topology.c - References: sys/kern/subr_cpu_topology.c:98, sys/kern/subr_cpu_topology.c:99
PoC changes
Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.
Fix validation
- fix.diff applies cleanly with
git apply --check -p1andpatch -p1 --forward. - Combined kernel build (
make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously. - Build log:
../../combined_40_low_severity_kernel_build.log(NK_DONE rc=0).
Recommended fix
Reorder the && so the bound check short-circuits first. Matches finding proposal.
Fix verification
fixedVALIDATED via combined kernel build rc=0.
baseline: array index before bound check / patched: bound check short-circuits first, build rc=0.
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- u
- b
- r
- _
- c
- p
- u
- _
- t
- o
- p
- o
- l
- o
- g
- y
- .
- c
- :
- 9
- 8
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- u
- b
- r
- _
- c
- p
- u
- _
- t
- o
- p
- o
- l
- o
- g
- y
- .
- c
- :
- 9
- 9
Detail
Exploit chain
none (boot-time OOB by one)
Evidence (decisive lines)
subr_cpu_topology.c:98 evaluates array index before :99 bound check.
PoC changes
Authored fix.diff: reorder && so the bound check short-circuits first.
Verified recommended fix
Reorder the && so next_apicid < NAPICID is evaluated first (short-circuit). Matches finding proposal.
Verdict
REPRODUCED (source-only, boot-time). subr_cpu_topology.c:98-99 get_next_valid_apicid: while(get_cpuid_from_apicid(next_apicid)==-1 && next_apicid<NAPICID) evaluates the array-indexing macro BEFORE the bound check. When next_apicid reaches NAPICID(256), get_cpuid_from_apicid reads apic_id_to_cpuid[256] (OOB by one) before the bound check aborts.
No comments yet.