Feed
OpenBSD

The kernel read past the end of a small memory map

Brief

The public text is one field past the end, not a leak or a crash.

Notes

6dfb82559f70462963d108fe3b99289c924e6bec landed Wednesday in -current (blackgnezdo, ok kettenis@). One file, sys/uvm/uvm_amap.c. The hash-bucket helper read the wrong arm of a union on a small amap. Offset 80 is already the end of an 80-byte small amap. Official log: source-changes, MARC, Codeberg.

Not labeled SECURITY FIX. Not on errata79 or errata78. The public text is an out-of-bounds read of one field. Do not upgrade this to an info leak or local root.

KASAN caught the one-field over-read.

Commit 6dfb82559f70462963d108fe3b99289c924e6bec

Sources