md_get_mbuf() ignores md_get_mem() failure (silent short copy / INVARIANTS panic) and md_done() leaves md_cur/md_pos dangling
| Field | Value |
|---|---|
| ID | DF-2907 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
| CWE | CWE-252 / CWE-459 |
| File | sys/kern/libmchain/subr_mchain.c |
| Lines | 511-521 (esp. :518), 323-330 |
| Area | libmchain (legacy smb consumer) |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | legacy |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
md_get_mbuf (:511-521) ignores the return of md_get_mem(mdp, NULL, size, MB_MZERO) at :518, so if size exceeds the remaining chain the caller still gets success with a short mbuf (on INVARIANTS kernels m_copym panics first via KASSERT). Separately, md_done (:323-330) clears only md_top, leaving md_cur/md_pos pointing at freed mbufs — a dangling-state hazard; in-tree dereference is currently prevented because smb_iod_waitrq only returns error==0 after a fresh record was attached, and every md_done caller re-inits before parsing, but any future caller that parses after a terminal md_done gets a UAF read with an attacker-groomable u_int count underflow in md_get_mem (:478-486). Latent/hardening. Fix: check md_get_mem's return in md_get_mbuf; clear md_cur/md_pos in md_done (already included in DF-2905's fix.diff).
Timeline
- 2026-09-02 Discovered during pass-2 audit of subr_mchain.c (GLM 5.3).
No comments yet.