DF-0222
csprng_get_random byte count signed int: huge u_int requests silently truncate to 0
Summary
csprng_get_random(...,int bytes,...)(:127) called from read_random(...,u_int nbytes,...). nbytes>INT_MAX -> bytes negative -> while(bytes>0) skipped -> returns 0. Silent short-read. API hygiene.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0222 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | csprng_get_random byte count signed int: huge u_int requests silently truncate t | 304 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/subr_csprng.c:127: csprng byte count signed int - huge requests silently truncate to 0
Verified recommended fix
Source-confirmed at sys/kern/subr_csprng.c:127: csprng byte count signed int - huge requests silently truncate to 0
Verdict
Source-confirmed at sys/kern/subr_csprng.c:127: csprng byte count signed int - huge requests silently truncate to 0
No comments yet.