link_elf: Uncapped dynamic-section walk (parse_dynamic)
Needs ReviewPublic
Actions

Authored by thebugfixers_pm.me on Jun 24 2026, 9:41 AM.

Tags

None

Referenced Files

	Unknown Object (File)
	Tue, Aug 18, 11:44 AM

	Unknown Object (File)
	Sun, Aug 16, 1:05 PM

	Unknown Object (File)
	Wed, Aug 12, 8:59 PM

	Unknown Object (File)
	Wed, Aug 12, 4:00 AM

	Unknown Object (File)
	Wed, Aug 12, 12:22 AM

	Unknown Object (File)
	Mon, Aug 10, 2:39 PM

	Unknown Object (File)
	Sun, Aug 9, 4:58 PM

	Unknown Object (File)
	Sat, Aug 8, 11:29 AM

View All 28 Files

Subscribers

imp

olce

Details

Reviewers

None

Group Reviewers

Src Committers
Contributor Reviews (src)

Summary

There is no limit on how far this loop advances. If the PT_DYNAMIC segment is malformed and lacks a DT_NULL terminator within its bounds, the kernel scans forward indefinitely.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

thebugfixers_pm.me created this revision.Jun 24 2026, 9:41 AM

Herald added subscribers: olce, imp. · View Herald TranscriptJun 24 2026, 9:41 AM

thebugfixers_pm.me requested review of this revision.Jun 24 2026, 9:41 AM

thebugfixers_pm.me added a parent revision: D57785: link_elf: Guard against subtraction underflow.Jun 26 2026, 5:25 PM

Revision Contents
Changeset List

Path

Size

sys/

kern/

link_elf.c

5 lines

Diff 180515

View Options

link_elf: Uncapped dynamic-section walk (parse_dynamic)Needs ReviewPublicActions