DF-0372
Undefined behavior shift 1 << if_dunit for member NIC unit numbers >= 32
Summary
RX-test bitmap check(:310) and TX-test(:1835) perform 1<<lp->lp_ifp->if_dunit where if_dunit is member NIC unit. For unit>=32 this is UB (shift >= width of int). u_int32_t bitmap cannot represent bits >=32 anyway. Debug facility misbehaves on dense NICs. No security impact.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0372 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Undefined behavior shift 1 << if_dunit for member NIC unit numbers >= 32 | 403 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/lagg/ieee8023ad_lacp.c:310: UB shift 1<<if_dunit for member NIC unit>=32
Verified recommended fix
Source-confirmed at sys/net/lagg/ieee8023ad_lacp.c:310: UB shift 1<
Verdict
Source-confirmed at sys/net/lagg/ieee8023ad_lacp.c:310: UB shift 1<
No comments yet.