⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0244

ldisc_deregister missing lower-bound check: negative index OOB write into linesw[]

Summary

ldisc_register validates discipline>=0&&<MAXLDISC(:105). ldisc_deregister only checks <MAXLDISC(:126). Signed int negative passes -> linesw[discipline]=nodisc(:127) writes before array. Kernel module callers only (root). Asymmetric with register. Defense-in-depth.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0244 · 1 files
FileTypeDescriptionSize
fix.diff suggested-fix ldisc_deregister missing lower-bound check: negative index OOB write into linesw 323 B view raw

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff applied + combined nativekernel build rc=0 (-Werror)

fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/kern/tty_conf.c:122: ldisc_deregister missing lower-bound check (negative index OOB)

Verified recommended fix

Source-confirmed at sys/kern/tty_conf.c:122: ldisc_deregister missing lower-bound check (negative index OOB)

Verdict

Source-confirmed at sys/kern/tty_conf.c:122: ldisc_deregister missing lower-bound check (negative index OOB)