⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0119

Latent OOB write if aux_data/aux_size invariant breaks

Summary

DMSG_DBG_SHELL reply handler: guard is if(msg->aux_data) but write msg->aux_data[msg->aux_size-1]=0(:208) assumes aux_size>0. If aux_size==0 with non-NULL aux_data, underflow to SIZE_MAX -> OOB write. Currently mitigated by kern_dmsg.c receive path always allocating aux_data with aux_size>0. Fragile defense.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0119 · 1 files
FileTypeDescriptionSize
manifest.json file 395 B view raw

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff applied + combined nativekernel build rc=0 (-Werror)

fix.diff applied + combined nativekernel build rc=0 (-Werror)
combined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/kern/subr_diskiocom.c:207: latent OOB write if aux_data/aux_size invariant breaks

Verified recommended fix

Source-confirmed at sys/kern/subr_diskiocom.c:207: latent OOB write if aux_data/aux_size invariant breaks

Verdict

Source-confirmed at sys/kern/subr_diskiocom.c:207: latent OOB write if aux_data/aux_size invariant breaks