DF-0123
kernenv_next unbounded walk of bootloader static env
Summary
kernenv_next(:510-521) scans byte-by-byte for double-NUL with no length bound. Malformed boot env missing terminator reads adjacent kernel memory. Requires compromised loader or memory corruption at boot. Combined with unpriv sysctl read -> kernel memory disclosure.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0123 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 392 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_environment.c:510: kernenv_next unbounded walk of bootloader static env
Verified recommended fix
Source-confirmed at sys/kern/kern_environment.c:510: kernenv_next unbounded walk of bootloader static env
Verdict
Source-confirmed at sys/kern/kern_environment.c:510: kernenv_next unbounded walk of bootloader static env
No comments yet.