DF-0385
config_red kfrees caller-owned possibly-embedded struct on red_lookup_depth==0 path: latent UAF — same as v1
Summary
config_red(:1364-1368) when red_lookup_depth==0: kfree(x,M_DUMMYNET)+return EINVAL. x can be &pipe->fs embedded in dn_pipe. set_fs_parms ignores return. Currently dead: red_lookup_depth CTLFLAG_RD sysctl default 256. Same latent UAF as DF-0377 (v1). Fix: dont free x; return EINVAL; let caller handle.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0385 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 399 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/dummynet3/ip_dummynet3.c:1364: config_red kfrees caller-owned possibly-embedded struct (latent UAF)
Verified recommended fix
Source-confirmed at sys/net/dummynet3/ip_dummynet3.c:1364: config_red kfrees caller-owned possibly-embedded struct (latent UAF)
Verdict
Source-confirmed at sys/net/dummynet3/ip_dummynet3.c:1364: config_red kfrees caller-owned possibly-embedded struct (latent UAF)
No comments yet.