tbridge_printf size_t underflow yields OOB kernel write once 128kB buffer fills
Summary
tbridge_printf (tbridge.c:139-143): i=kvsnprintf(ptr,remsz,fmt,args); ptr+=i; remsz-=i. kvsnprintf returns C99 would-have-been-written length EXCLUDING NUL even when truncated (subr_prf.c:455-467,549 increments retval regardless of snprintf_func dropping at 494-502). Once 128kB static buffer (tbridge.c:61) fills past remsz, returned i > remsz; unsigned size_t subtraction wraps to ~SIZE_MAX; ptr advanced past buffer end. Every subsequent tbridge_printf writes off end of tbridge_msgbuf into adjacent BSS (tbridge_msgbuf_ptr and tbridge_msgbuf_remsz at 61-63 are first overwritten). Controlled stream steers ptr to arbitrary address -> write-what-where. Module is optional tbridge not in default kernel; cdev 0600 root:wheel (312-317). Root-only but genuine kernel memory corruption. AV:L/PR:H/AC:L, I:H/A:H.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2047 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source-confirmation verdict for DF-2047 | 636 B | ↓ raw |
| fix.diff | suggested-fix | Clamp i to remsz to prevent size_t underflow in tbridge_printf | 1010 B | view raw |
| ../fix_build.log | build-log | Batch kernel build log (all fixes, rc=0) | 5.6 MB | ↓ download |
DF-2047 Verification Verdict
Severity: Low Impact class: oob_write Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)
Verdict: REPRODUCED (source-confirmed)
The bug is confirmed in the audited source at the cited path:line. Triggerable but requires specific driver/config.
Fix: Clamp i to remsz to prevent size_t underflow in tbridge_printf
Fix applied and validated in batch kernel build (rc=0, -Werror).
Fix validation
All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build.
Build result: rc=0, 0 errors (full -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): tbridge_printf: i=kvsnprintf(ptr,remsz,fmt,args); ptr+=i; remsz-=i. kvsnprintf returns C99 would-have-been-written length even when truncated; ptr+=i overruns buffer; remsz-=
Verified recommended fix
REPRODUCED (source-only): tbridge_printf: i=kvsnprintf(ptr,remsz,fmt,args); ptr+=i; remsz-=i. kvsnprintf returns C99 would-have-been-written length even when truncated; ptr+=i overruns buffer; remsz-=i underflows.
Verdict
REPRODUCED (source-only): tbridge_printf: i=kvsnprintf(ptr,remsz,fmt,args); ptr+=i; remsz-=i. kvsnprintf returns C99 would-have-been-written length even when truncated; ptr+=i overruns buffer; remsz-=i underflows.
No comments yet.