DF-0247
cpuid bounds check is KASSERT-only — compiled out in production kernels
Summary
cpuhelper_domsg(:102-108) indexes cpuhelper[cpuid] with only KASSERT guard(:106). KASSERT compiled out without INVARIANTS(systm.h:117-118). Out-of-range cpuid -> OOB array access -> garbage pointer deref. Kernel-internal API, not directly unpriv-reachable.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0247 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 390 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/subr_cpuhelper.c:45: cpuid bounds check is KASSERT-only (compiled out in production)
Verified recommended fix
Source-confirmed at sys/kern/subr_cpuhelper.c:45: cpuid bounds check is KASSERT-only (compiled out in production)
Verdict
Source-confirmed at sys/kern/subr_cpuhelper.c:45: cpuid bounds check is KASSERT-only (compiled out in production)
No comments yet.