⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2722

kstrndup() reads one byte past the maxlen-bounded source when no NUL is present

Field Value
ID DF-2722
Status new
Severity Low
CVSS 3.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
CWE CWE-125 / CWE-193
File sys/kern/kern_slaballoc.c
Lines 1324-1327
Area kern
Confidence certain
Discovered 2026-08-30
Pass 2 (GLM 5.3 second pass)
Bucket base:kern
Reported pending
Known CVE none
CVE match novel

Summary

When str[0..maxlen-1] contains no NUL, zlen = strnlen(str,maxlen)+1 == maxlen+1 and bcopy(str, nstr, zlen) reads str[maxlen] — one byte beyond the region strnlen validated. The stray byte is immediately overwritten by nstr[zlen-1]='\0', so nothing escapes; worst case is a kernel page fault if str+maxlen lands exactly at an unmapped-page boundary. Only three in-tree callers, all in autofs with kernel-internal name components under root-configured automounts.

-   bcopy(str, nstr, zlen);
+   bcopy(str, nstr, zlen - 1); /* never read str[maxlen] */
    nstr[zlen - 1] = '\0';

Timeline

  • 2026-08-30 Discovered during pass-2 audit of kern_slaballoc.c (GLM 5.3).

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2722 · 3 files
FileTypeDescriptionSize
v26harness.c — 14.3 KB view raw
run.log — 373 B view raw
fix.diff — 527 B view raw

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

Patched kernel: kstrndup with str[maxlen] on an unmapped guard page completes normally (SURVIVED kstrndup) - the one-byte overread is gone; baseline was Fatal trap 12 in memcpy+0x61.

cmd=9 on patched kernel: SURVIVED kstrndup (d=0xfffff8004f0e78f8)
↓ fix.diffDragonFly dfbsd 6.5-DEVELOPMENT #1: Sat Oct 24 17:14:55 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (v26 fix-all kernel; sys_generic.c fix-v2 rebuild pending A/B)

Confirmed kernel references

Detail

Exploit chain

kldload harness -> guard-page string -> kstrndup(maxlen) -> bcopy reads str[maxlen] -> kernel page fault -> panic

Evidence (decisive lines)

v26harness.c t9 (cmd=9); df2722_mod.log: Fatal trap 12 at memcpy+0x61, str[16] on unmapped page

PoC changes

none

Verified recommended fix

--- sys/kern/kern_slaballoc.c 2026-06-29 12:51:19.000000000 +0000

Verdict

Reproduced with a kernel-module guard-page harness: kstrndup (sys/kern/kern_slaballoc.c:1315-1329) computes zlen = strnlen(str, maxlen) + 1 and bcopy(str, nstr, zlen); with no NUL in the first maxlen bytes zlen == maxlen+1 and the bcopy reads str[maxlen] - one byte past the maxlen-bounded region. The harness placed a 16-byte non-NUL string at the last 16 bytes of a mapped kernel page with the following page unmapped; kstrndup(str, 16) faulted reading exactly str[16] on the guard page: Fatal trap 12: page fault while in kernel mode, stopped at memcpy+0x61 inside the bcopy. The overread byte is immediately overwritten by the NUL terminator so nothing escapes (no info leak); the demonstrated impact is the fault/panic at an unmapped boundary. In-tree callers (autofs, kernel-internal names) are root/boot-configured, so there is no unprivileged trigger on this guest; the byte-overrun itself is proven deterministically.