DF-4609
Uninitialized stack value used as relocation buffer bound before session validation
Summary
'size' points to an uninitialized tmp and the session_idx check runs after the command switch, so the first encode/context command passes kernel-stack garbage into cs_reloc's size comparison before the EINVAL rejects the CS - a bounds decision on a doomed IB. Negligible standalone; hardening. Init-tmp + hoist-the-session-check fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4609 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
init tmp=0 and/or hoist the session_idx check before the switch in finding markdown
per-fix-DF-4609
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
size points to an uninitialized tmp and the session_idx check runs AFTER the command switch, so the first encode/context command passes garbage into cs_reloc's size comparison before the EINVAL. The rejected IB frees the patched memory - no executed command depends on it. Low/Info; no pack per contract.
Verdict
not_run: Low hardening; comparison-only sink on a doomed IB
No comments yet.