Unbounded mbuf-to-stack copy in slstart BPF path: latent stack overflow
Summary
slstart(:536,594-603): u_char bpfbuf[SLTMAX+SLIP_HDRLEN]=1516 bytes on stack. Copies whole outbound mbuf chain into it(cp=bpfbuf+SLIP_HDRLEN loop :597-603) NO explicit check len<=SLTMAX. Comment :588-591 acknowledges assumption packets should be short. Bounding relies entirely on MTU enforcement(SIOCSIFMTU caps SLTMAX=1500 :993 ip_output fragments). No known trigger today. Any future change letting oversized mbuf reach slstart -> stack overflow. Fix: if(len+mlen>SLTMAX) break.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0579 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 388 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/sl/if_sl.c:536: unbounded mbuf-to-stack copy in slstart BPF path (latent stack overflow)
Verified recommended fix
Source-confirmed at sys/net/sl/if_sl.c:536: unbounded mbuf-to-stack copy in slstart BPF path (latent stack overflow)
Verdict
Source-confirmed at sys/net/sl/if_sl.c:536: unbounded mbuf-to-stack copy in slstart BPF path (latent stack overflow)
No comments yet.