⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0460

status_frac / tx_frac sysctls have no upper bound: signed int overflow in ifpoll_compat_setup

Summary

sysctl_stfrac(:1497)/sysctl_txfrac(:1535) reject <1 but no upper bound. Root can set INT_MAX. ifpoll_compat_setup(:1569-1570) (poll_stfrac+1)*howmany(IOPOLL_BURST_MAX,IOPOLL_EACH_BURST)-1 multiplies INT_MAX*5 = signed int overflow UB. Garbage ifpc_stfrac feeds driver compat polling state. No memory corruption. Fix: upper-bound clamp.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0460 · 1 files
FileTypeDescriptionSize
manifest.json file 384 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/net/if_poll.c:1497: status_frac/tx_frac sysctls have no upper bound (signed int overflow)

Verified recommended fix

Source-confirmed at sys/net/if_poll.c:1497: status_frac/tx_frac sysctls have no upper bound (signed int overflow)

Verdict

Source-confirmed at sys/net/if_poll.c:1497: status_frac/tx_frac sysctls have no upper bound (signed int overflow)