DF-0114
PT_IO trusts user piod_len without bounds check; narrows size_t into ssize_t uio_resid
Summary
PT_IO path assigns piod->piod_len(size_t) directly to uio_resid(ssize_t)(:442). piod_len>SSIZE_MAX becomes negative uio_resid. No corruption: procfs_rwmem clamps via szmin(PAGE_SIZE,...) per iteration. Only effect: garbage piod_len accounting returned. Hardening gap.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0114 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | PT_IO trusts user piod_len without bounds check; narrows size_t into ssize_t uio | 427 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/sys_process.c:429: PT_IO narrows size_t piod_len into ssize_t uio_resid
Verified recommended fix
Source-confirmed at sys/kern/sys_process.c:429: PT_IO narrows size_t piod_len into ssize_t uio_resid
Verdict
Source-confirmed at sys/kern/sys_process.c:429: PT_IO narrows size_t piod_len into ssize_t uio_resid
No comments yet.