DF-0902
setfs() leaves path buffer non-null-terminated after strncpy (latent OOB-read in strlen)
Summary
nfs_mountrpc.c:347 strncpy(path,p,MNAMELEN-1) NO forced NUL termination. path consumed as C string by md_mount strlen(path) :143/:160 then xdr_string_encode bcopy. Today masked by BSS zero-init of nfsv3_diskless (vfsops.c:147). Fragile: one refactor from OOB read/leak/panic. BOOTP TAG_ROOT/TAG_SWAP attacker-controlled up to TAG_MAXLEN=1024. Paths >79 bytes leave path[79] unset. Fix: path[MNAMELEN-1]=\0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0902 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | setfs() leaves path buffer non-null-terminated after strncpy (latent OOB-read in | 251 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/vfs/nfs/nfs_mountrpc.c:347: setfs leaves path buffer non-null-terminated after strncpy (latent OOB read)
Verified recommended fix
Source-confirmed at sys/vfs/nfs/nfs_mountrpc.c:347: setfs leaves path buffer non-null-terminated after strncpy (latent OOB read)
Verdict
Source-confirmed at sys/vfs/nfs/nfs_mountrpc.c:347: setfs leaves path buffer non-null-terminated after strncpy (latent OOB read)
No comments yet.