DF-0100
Missing NULL check on vfsconf_find_by_name("devfs") before dereference in vfs_mountroot_devfs
Summary
vfs_mountroot_devfs (vfs_conf.c:300-311): vfsp=vfsconf_find_by_name("devfs") immediately dereffed :306 mount_init(mp,vfsp->vfc_vfsops) :308 mp->mnt_vfc=vfsp :310 vfsp->vfc_refcount++ no NULL test. If devfs not registered -> NULL deref panic. Stock kernel always compiles devfs so never NULL in practice. Hardening gap no attacker trigger. Fix: if(vfsp==NULL) return ENODEV.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0100 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Missing NULL check on vfsconf_find_by_name("devfs") before dereference in vfs_mo | 315 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/vfs_conf.c:300: missing NULL check on devfs vfsconf before deref
Verified recommended fix
Source-confirmed at sys/kern/vfs_conf.c:300: missing NULL check on devfs vfsconf before deref
Verdict
Source-confirmed at sys/kern/vfs_conf.c:300: missing NULL check on devfs vfsconf before deref
No comments yet.