DF-2887
uiomove/uiomovez/uiomove_fromphys/ureadc walk the iovec array with no uio_iovcnt guard — OOB iov walk on any inconsistent uio
| Field | Value |
|---|---|
| ID | DF-2887 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-125 (defense-in-depth) |
| File | sys/kern/kern_subr.c |
| Lines | 120-124, 236-240, 297-301, 566-570 |
| Area | kern |
| Confidence | speculative |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
All four uio consumers advance uio_iov/uio_iovcnt on zero-length iovecs without checking uio_iovcnt > 0. They rely solely on the invariant uio_resid == sum(remaining iov_len); a uio left inconsistent by a consumer bug (the exact class DF-2626 exposed) walks the iov pointer past the end of the caller's array — reading iov_len/iov_base from adjacent kernel memory and copyin/copyouting through whatever it finds. No demonstrated path today; hardening: bail with EFAULT in the zero-length advance when iovcnt < 1 (never fires for consistent uios).
Timeline
- 2026-09-02 Discovered during pass-2 audit of kern_subr.c (GLM 5.3).
No comments yet.