DF-0121
Signed/unsigned confusion defeats length clamp in KENV_GET
Summary
KENV_GET: size_t len vs int uap->len comparison(:142). Negative uap->len promotes to SIZE_MAX, clamp skipped, copyout writes strlen(value)+1 bytes (max 129). Caller can only overwrite own buffer. API correctness issue.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0121 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Signed/unsigned confusion defeats length clamp in KENV_GET | 345 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_environment.c:141: signed/unsigned confusion defeats length clamp in KENV_GET
Verified recommended fix
Source-confirmed at sys/kern/kern_environment.c:141: signed/unsigned confusion defeats length clamp in KENV_GET
Verdict
Source-confirmed at sys/kern/kern_environment.c:141: signed/unsigned confusion defeats length clamp in KENV_GET
No comments yet.