nfs_getauth()/nfs_savenickauth() take NFSKERBKEY_T (u_char[2]) as a parameter but bcopy sizeof(NFSKERBKEY_T) == 8 bytes into/out of 2-byte struct members — padding-absorbed today, latent overflow on any layout change
Summary
NFSKERBKEY_T is typedef u_char[2] (rpcv2.h:133). Both functions declare it as a by-value array parameter - decays to u_char* - then use sizeof(NFSKERBKEY_T), which inside the function is the pointer size (8 on x86_64), not 2. nfs_getauth:1075 bcopy's 8 bytes from nmp->nm_key (2-byte member, 6-byte in-struct overread) into req->r_key (absorbed by padding); nfs_savenickauth:1208 bcopy's 8 bytes into nuidp->nu_key (offset 284 of the 320-byte struct nfsuid, 6 extra bytes in allocator padding). No OOB on this platform/compiler today; becomes a real heap overflow if the struct tail shrinks, cache-line changes, or the key type widens. NFSKERB encryption #ifdef'd out so the bytes never reach the wire. Hardening. Fix: sizeof(nmp->nm_key)/sizeof(nuidp->nu_key). [VERIFIED pass2: sizeof NFSKERBKEY 8 vs 2-byte members confirmed padding-absorbed on this ABI; sizeof-member fix compiled]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3089 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 236 B | ↓ raw | |
| fix.diff | — | 814 B | view raw | |
| manifest.json | — | 387 B | view raw | |
| verdict.json | — | 1.7 KB | view raw |
DF-3089 evidence pack
What
NFSKERBKEY_T by-value parameter: sizeof is 8, member is 2 bytes
Verdict
status=not_reproduced impact=none confidence=certain
See VERDICT.md for the full narrative and fix.diff for the verified fix.
Fix verification
not_testablefix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)
Confirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff
PoC changes
n/a - padding-absorbed on this ABI
Verified recommended fix
bcopy sizeof(nmp->nm_key)/sizeof(nuidp->nu_key) instead of the decayed parameter type
Verdict
Line-accurate confirmation; no runtime manifestation exists on this platform/compiler (both copies are absorbed by struct padding). NFSKERBKEY_T is u_char[2] (rpcv2.h:133); both nfs_getauth and nfs_savenickauth declare it as a by-value array parameter, so sizeof(NFSKERBKEY_T) inside the function is the pointer size 8: nfs_getauth bcopys 8 bytes out of the 2-byte nmp->nm_key (6-byte in-struct overread, nfs_syscalls.c:1075) and nfs_savenickauth bcopys 8 bytes into the 2-byte nuidp->nu_key at offset ~284 of the 320-byte struct nfsuid (6 bytes into allocator padding, :1208). Fix copies sizeof(member) (2) at both sites; compiled in the F40FIX build.
No comments yet.