β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-0466

Potentially unaligned 64-bit write constructing transport AEAD nonce

Summary

Transport nonce built via *(uint64_t*)(nonce+4)=htole64(counter)(:996-997,:1024-1025) on stack uint8_t nonce[12] with no alignment guarantee. Strict-aliasing UB. Transparent on x86-64 (primary target). Portability concern only β€” bus error on ARM/SPARC/MIPS strict-alignment ports. No security impact. Fix: use memcpy.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0466 Β· 1 files
FileTypeDescriptionSize
manifest.json file 386 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/net/wg/wg_noise.c:996: potentially unaligned 64-bit write constructing transport AEAD nonce

Verified recommended fix

Source-confirmed at sys/net/wg/wg_noise.c:996: potentially unaligned 64-bit write constructing transport AEAD nonce

Verdict

Source-confirmed at sys/net/wg/wg_noise.c:996: potentially unaligned 64-bit write constructing transport AEAD nonce