DF-0164
sys_modstat copyout non-NUL-terminated module name when name>=MAXMODNAME
Summary
sys_modstat(:348-351) namelen=strlen+1 clamped to MAXMODNAME. When mod name>=MAXMODNAME bytes, copyout writes MAXMODNAME with no NUL. User buffer is char[MAXMODNAME]. No kernel leak. Userland consumer treating as C string may over-read.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0164 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | sys_modstat copyout non-NUL-terminated module name when name>=MAXMODNAME | 619 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_module.c:348: sys_modstat copyout non-NUL-terminated module name when name>=MAXMODNAME
Verified recommended fix
Source-confirmed at sys/kern/kern_module.c:348: sys_modstat copyout non-NUL-terminated module name when name>=MAXMODNAME
Verdict
Source-confirmed at sys/kern/kern_module.c:348: sys_modstat copyout non-NUL-terminated module name when name>=MAXMODNAME
No comments yet.