DF-0459
user_frac sysctl accepts any uint32 without range validation (documented 0-100)
Summary
user_frac SYSCTL_ADD_UINT(:1116-1117) no handler no range check. Doc says 0-100. Line :1022 kern_load>(100-user_frac) unsigned wraps to ~4G when user_frac>100 disabling burst-reduction path entirely. Root self-DoS. Other sysctls (pollhz,burst_max,each_burst) have proper clamping handlers.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0459 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 384 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/if_poll.c:1116: user_frac sysctl accepts any uint32 without range validation (doc 0-100)
Verified recommended fix
Source-confirmed at sys/net/if_poll.c:1116: user_frac sysctl accepts any uint32 without range validation (doc 0-100)
Verdict
Source-confirmed at sys/net/if_poll.c:1116: user_frac sysctl accepts any uint32 without range validation (doc 0-100)
No comments yet.