DF-0440
red_pkttime computed as int64 then stored into int: truncation/overflow for jumbo MTU or low m2
Summary
altq_hfsc.c(:451-460): red_pkttime declared int(:433) but assigned (int64_t)if_mtu*1000*1000*1000/(m2/8)(:454-455). Jumbo MTU=9000 m2=8: 9e12 >> INT_MAX -> narrowing store truncates to garbage/negative. Passed to red_alloc. Gated ALTQ_RED+HFCF_RED both privileged. Affects shaping correctness not security.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0440 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 389 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/altq/altq_hfsc.c:451: red_pkttime int truncation for jumbo MTU or low m2
Verified recommended fix
Source-confirmed at sys/net/altq/altq_hfsc.c:451: red_pkttime int truncation for jumbo MTU or low m2
Verdict
Source-confirmed at sys/net/altq/altq_hfsc.c:451: red_pkttime int truncation for jumbo MTU or low m2
No comments yet.