DF-0188
No defense-in-depth privilege check; acl_cnt not bounds-validated pre-VOP
Summary
No priv_check/ownership check in syscall layer (relies on nlookup search perms + VOP). acl_cnt copyin(:74) not clamped [0,ACL_MAX_ENTRIES] before VOP_SETACL(:80). Naive FS impl could read OOB. Latent defense-in-depth.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0188 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 383 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_acl.c:74: no defense-in-depth priv check; acl_cnt not bounds-validated
Verified recommended fix
Source-confirmed at sys/kern/kern_acl.c:74: no defense-in-depth priv check; acl_cnt not bounds-validated
Verdict
Source-confirmed at sys/kern/kern_acl.c:74: no defense-in-depth priv check; acl_cnt not bounds-validated
No comments yet.