DF-0488
Hash secret only 32-bit + sc_flags 8-bit near exhaustion: hardening gaps
Summary
hash_secret u_int(32-bit)(:157,:336) trivial XOR fold bucket hash. sc_flags u_int8_t(:521) SCF_* uses 7/8 bits(:522-528) no room for new flags. Reduces cost of hash-flood weakness(DF-0485). Fix: widen key to 128-bit keyed hash, widen sc_flags to u_int32_t.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0488 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 392 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netinet/tcp_syncache.c:118: hash secret only 32-bit + sc_flags 8-bit near exhaustion
Verified recommended fix
Source-confirmed at sys/netinet/tcp_syncache.c:118: hash secret only 32-bit + sc_flags 8-bit near exhaustion
Verdict
Source-confirmed at sys/netinet/tcp_syncache.c:118: hash secret only 32-bit + sc_flags 8-bit near exhaustion
No comments yet.