DF-0444
rmc_newclass does not reject negative priority: only checks upper bound, latent negative array index
Summary
rmc_newclass(int pri,...)(:201): only checks pri>=RM_MAXPRIO, not pri<0. Indexes ifd->active_[pri](:304), num_[pri](:331), alloc_[pri](:332) — RM_MAXPRIO(8) sized arrays. Negative pri -> negative array index OOB read/write. Currently unreachable: sole caller passes u_int8_t pre-checked CBQ_MAXPRI. API defense-in-depth.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0444 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | rmc_newclass does not reject negative priority: only checks upper bound, latent | 316 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/altq/altq_rmclass.c:201: rmc_newclass does not reject negative priority (latent neg array index)
Verified recommended fix
Source-confirmed at sys/net/altq/altq_rmclass.c:201: rmc_newclass does not reject negative priority (latent neg array index)
Verdict
Source-confirmed at sys/net/altq/altq_rmclass.c:201: rmc_newclass does not reject negative priority (latent neg array index)
No comments yet.