DF-2895
sys_kenv KENV_SET ignores ksetenv() failure — variables rejected at limit boundaries (name/value of exactly KENV_M*LEN, full table) silently appear 'set'
| Field | Value |
|---|---|
| ID | DF-2895 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CWE | CWE-252 Unchecked Return Value |
| File | sys/kern/kern_environment.c |
| Lines | 164 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
sys_kenv() calls ksetenv(name, value) and discards its return; ksetenv returns −1 (and sets nothing) when strlen(name)==128, the value hits the same boundary, or the dynamic table is full (512 entries). The privileged caller sees syscall success while the variable was never stored — silent configuration drop for boot-time tunables set at runtime. Info: not memory-unsafe; privileged-only. Fix: propagate EINVAL.
Timeline
- 2026-09-02 Discovered during pass-2 audit of kern_environment.c (GLM 5.3).
No comments yet.