DF-0339
tcp_new_isn last_offset signed int overflow-wrap on churn (UB / monotonicity erosion)
Summary
struct tcp_isn.last_offset(:1674) is int accumulated += 0x10000000/reseed + ~0x100000/mint. Signed overflow UB after ~2K mints. tcp_isn_reseed_interval root-writable negative -> huge unsigned threshold disabling reseeds. ISN quality degradation.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0339 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 388 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netinet/tcp_subr.c:1670: tcp_new_isn last_offset signed int overflow-wrap on churn (UB)
Verified recommended fix
Source-confirmed at sys/netinet/tcp_subr.c:1670: tcp_new_isn last_offset signed int overflow-wrap on churn (UB)
Verdict
Source-confirmed at sys/netinet/tcp_subr.c:1670: tcp_new_isn last_offset signed int overflow-wrap on churn (UB)
No comments yet.