Safety-critical checks rely on KASSERT/KKASSERT which are no-ops on production kernels without INVARIANTS
Summary
KASSERT/KKASSERT no-op without INVARIANTS (systm.h:117-119). Safety-critical guards in this file: KASSERT(m_len>=ETHER_HDR_LEN)(:993) prevents OOB ether_header read in ether_demux; KKASSERT(mtag!=NULL)(:1003) before m_tag_data NULL deref; KKASSERT(ether_type!=VLAN)(:1370) recursion guard; KKASSERT(M_HASH)(:1452) before hashcpu. Production kernels: all become no-ops. Buggy driver short mbuf or refcount race -> exploitable OOB/NULL-deref instead of controlled panic.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0448 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 388 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/if_ethersubr.c:993: safety-critical checks rely on KASSERT (no-op on production)
Verified recommended fix
Source-confirmed at sys/net/if_ethersubr.c:993: safety-critical checks rely on KASSERT (no-op on production)
Verdict
Source-confirmed at sys/net/if_ethersubr.c:993: safety-critical checks rely on KASSERT (no-op on production)
No comments yet.