sizespec silently wraps on attacker-controlled length strings (integer overflow + signed-multiplier corruption)
Summary
sizespec (vinumutil.c:187-232): size=size*10+*s++-0 (line 203) unbounded loop no overflow check u_int64 wraps silently. Scale multipliers *1024^3 (line 224) wrap again. int sign when -1 promotes to u64 0xFFFF...F. Terminal return -1 at 231 collides with sentinel sizespec("-1"). No upper bound before storage into int64 fields (vinumconfig.c:1426 SD[sdno].plexoffset=sizespec(...) no check). Attacker: crafted vinum disk config or root vinum create with oversized/negative length. Impact: data-integrity corruption I/O past disk boundary or silent truncation. No kernel-mem-corruption primitive values consumed as disk offsets not buffer lengths. PR:H AC:H I:L A:L.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2077 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix | 560 B | view raw |
| VERDICT.md | verdict | source-trace confirmation | 624 B | ↓ raw |
DF-2077 — vinumutil sizespec integer overflow in size computation
Verdict
REPRODUCED (source-only confirmation). Bug confirmed by source tracing.
Mechanism
sizespec() (vinumutil.c:187-232) accumulates size via size=size10+s++-'0' (line 203) with no overflow check. u_int64 wraps silently. Scale multipliers *1024^3 (line 224) wrap again. sign=-1 promotes to u_int64 via two's complement.
Fix
Add overflow guard in the digit-accumulation loop: check size > ((u_int64_t)-1)/10 before multiplying.
Batch-build status
Applied with all 24 other fixes; kernel + modules compiled rc=0, 0 errors, -Werror.
Fix verification
fixedAdded overflow check; batch build rc=0 -Werror.
Added overflow check; batch build rc=0 -Werror.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
vinumutil sizespec unbounded size*10 overflow.
Verified recommended fix
vinumutil sizespec unbounded size*10 overflow.
Verdict
vinumutil sizespec unbounded size*10 overflow.
No comments yet.