DF-2912
l64_makevirginlabel unsigned underflow on tiny slices: d_abase = d_total_size - ressize (and derived d_pstop) wrap to ~2^64 when the slice is smaller than the reserved area
| Field | Value |
|---|---|
| ID | DF-2912 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L |
| CWE | CWE-191 Integer Underflow |
| File | sys/kern/subr_disklabel64.c |
| Lines | 474-491 (esp. :482), 465-467 |
| Area | kern/disk |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
In l64_makevirginlabel, ressize is at least 4096. For a slice smaller than that (craftable via a 1-sector MBR slice, cf. DF-2904 family), lp->d_abase = lp->d_total_size - ressize underflows to ~2^64 and d_pstop becomes similarly huge; d_pbase also exceeds d_total_size. DIOCGDVIRGIN64 then returns this bogus label, and because l64_setdisklabel accepts the misaligned-only-checked d_abase while rejecting every partition, disklabel64(8) cannot label such tiny slices — functional self-DoS with no kernel memory impact (no in-kernel consumer of d_abase; only userland/boot code reads it). Fix: clamp or refuse when d_total_size < ressize.
Timeline
- 2026-09-02 Discovered during pass-2 audit of subr_disklabel64.c (GLM 5.3).
No comments yet.