DF-0335
in_pcbportrange can invert hi<lo causing u_short underflow and out-of-range port binds
Summary
in_pcbportrange(:2533-2555) computes hi/lo in int then writes u_short. Narrow range+step can invert hi<lo. in_pcbsetlport lport=last-first in u_short underflows. KKASSERT(last>=first) covers pre-adjusted first0/last0 only. Out-of-range ephemeral port assignment. Root-gated precondition.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0335 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 386 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netinet/in_pcb.c:2533: in_pcbportrange can invert hi<lo causing u_short underflow
Verified recommended fix
Source-confirmed at sys/netinet/in_pcb.c:2533: in_pcbportrange can invert hi<lo causing u_short underflow
Verdict
Source-confirmed at sys/netinet/in_pcb.c:2533: in_pcbportrange can invert hi<lo causing u_short underflow
No comments yet.