DF-0122
kgetenv_quad signed-shift overflow on magnitude-suffixed values
Summary
kgetenv_quad(:436-457) left-shifts int64_t by 10 per K/M/G/T suffix with no overflow check. Value near INT64_MAX+suffix = signed overflow (UB). Boot-time loader.conf only. Downstream consumers get wild magnitude.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0122 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 393 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_environment.c:436: kgetenv_quad signed-shift overflow on magnitude-suffixed values
Verified recommended fix
Source-confirmed at sys/kern/kern_environment.c:436: kgetenv_quad signed-shift overflow on magnitude-suffixed values
Verdict
Source-confirmed at sys/kern/kern_environment.c:436: kgetenv_quad signed-shift overflow on magnitude-suffixed values
No comments yet.