fattime2timespec accepts out-of-range month (0, 13-15) and hour>23/minute>59 fields from crafted FAT images — no bounds validation (garbage dates, index safely masked)
| Field | Value |
|---|---|
| ID | DF-2957 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CWE | CWE-20 |
| File | sys/kern/subr_fattime.c |
| Lines | 226-239 |
| Area | kern/msdosfs |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
Unlike the day field (DF-0199), the month field is never range-checked: crafted dd with month 0 or 13-15 indexes daytab entries 0/14/15 via the safely-masked (dd>>5)&0x3f, landing the date in January of the cycle — month 0 with year 127 decodes as 2104-01-15 (interacting with the DF-2955 wrap); month 13/15 similarly alias into January. Likewise hh up to 31 and mm up to 63 produce times up to 31.5h that spill into the following day (verified on guest harness: dd=0x0021 dt=0xffff dh=0xff → 1980-01-02 08:04:04.55). No OOB is possible (mask + table geometry proven); tv_nsec stays canonical. Same wrong-mtime impact class as DF-0199 — a maintainer fixing DF-0199 should clamp all fields at the msdosfs parse boundary (row diff). Harness output in the DF-2955 pack; Phase V skipped per Low/Info rule.
Timeline
- 2026-09-02 Discovered during pass-2 audit of subr_fattime.c (GLM 5.3).
No comments yet.