DF-2770
ptcread TIOCPKT_IOCTL path ignores uiomove error: EFAULT swallowed, read() returns 0 (EOF-like) with control byte consumed
| Field | Value |
|---|---|
| ID | DF-2770 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-252 Unchecked Return Value |
| File | sys/kern/tty_pty.c |
| Lines | 718-723 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
In ptcread's packet-mode branch, the struct termios copyback's return value is discarded: on a faulting user buffer the master's read() still returns 0 — indistinguishable from EOF — after consuming pt_send and any partial data. Master-side packet consumers (script/tmux-style) can mis-detect slave closure. Memory-safe (cc is szmin-bounded both ways); hardening-class.
Recommended fix
Capture and propagate the uiomove error.
Timeline
- 2026-08-30 Discovered during pass-2 audit of tty_pty.c (GLM 5.3).
No comments yet.