DF-0357
nd6_cache_lladdr ignores lladdrlen parameter, uses ifp->if_addrlen for bcopy
Summary
nd6_cache_lladdr(:1768-1769) bcopy(lladdr,LLADDR(sdl),ifp->if_addrlen) ignores lladdrlen param. Comment(:1700) defers validation to callers. All 5 current callers validate. Future caller forgetting -> over-read. API safety hardening.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0357 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | nd6_cache_lladdr ignores lladdrlen parameter, uses ifp->if_addrlen for bcopy | 382 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netinet6/nd6.c:1768: nd6_cache_lladdr ignores lladdrlen param, uses ifp->if_addrlen
Verified recommended fix
Source-confirmed at sys/netinet6/nd6.c:1768: nd6_cache_lladdr ignores lladdrlen param, uses ifp->if_addrlen
Verdict
Source-confirmed at sys/netinet6/nd6.c:1768: nd6_cache_lladdr ignores lladdrlen param, uses ifp->if_addrlen
No comments yet.