DF-0405
Missing null-termination of bdg_basename when namelen==IFNAMSIZ: OOB read in debug format strings
Summary
nm_find_bridge(:331-352): namelen capped to IFNAMSIZ(16), strncpy(bdg_basename,name,namelen) into bdg_basename[16] with no guaranteed NUL when namelen==16. D() %s format reads past array. Debug-only. Defense-in-depth.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0405 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Missing null-termination of bdg_basename when namelen==IFNAMSIZ: OOB read in deb | 443 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/netmap/netmap_vale.c:331: missing null-termination of bdg_basename when namelen==IFNAMSIZ
Verified recommended fix
Source-confirmed at sys/net/netmap/netmap_vale.c:331: missing null-termination of bdg_basename when namelen==IFNAMSIZ
Verdict
Source-confirmed at sys/net/netmap/netmap_vale.c:331: missing null-termination of bdg_basename when namelen==IFNAMSIZ
No comments yet.