hurd: 6 CWE-407 defects confirmed — auth, libports, proc, idvec

whitepaper/outreach/hurd.md

@@ -1,25 +1,52 @@
-# GNU Hurd — CWE-407 Scan Queue
-**2026-04-04 · Scan in progress**
+# GNU Hurd — CWE-407 Disclosure Brief
+**2026-04-04 · 6 confirmed defects · Patches in progress**
 
-## Target
+## Finding
 
-GNU Hurd microkernel OS — main Hurd translators (`hurd.git`), GNU Mach kernel (`gnumach.git`), and `libpthread`.
+Six O(N²) / O(N×k) algorithmic complexity defects across GNU Hurd's auth server, `libports` notification infrastructure, `proc` server, and `libshouldbeinlibc` ID vector library. All are linear scan patterns in IPC-critical hot paths where hash or sorted structures should be used.
 
-Primary language: C. Primary IPC mechanism: Mach ports.
+## The Defects
 
-## Scan Focus
+**hurd-0001 (HIGH):** `auth/auth.c:162` — `S_auth_makeauth`
 
-- `libports/` — port/capability lookup tables, bucket walks
-- `libdiskfs/`, `libtrivfs/`, `libnetfs/` — server loop message dispatch
-- Translator registration and lookup in core translators
-- Any linked-list walk inside another linked-list walk
-- `strcmp`-in-loop patterns over growing name tables
+Four nested loops over `nauths × n{e,a}uids/n{e,a}gids`. Each `isuid()`/`groupmember()` call expands to `idvec_contains()` → `idvec_tail_contains()` — a pointer-walk linear scan over every UID in the auth handle.
+
+```c
+for (i = 0; i < neuids; i++) {
+  for (j = 0; j < nauths; j++)
+    if (auths[j] && isuid(euids[i], auths[j]))  // O(k) scan per call
+      { has_it = 1; break; }
+}
+// repeated for nauids, negids, nagids
+```
+
+O(N×M×k) total. Called on every `exec`, `setuid`, `auth_makeauth` RPC — the spine of Hurd's privilege model. Fix: build a `uid_t` hash set from the union of all `auths[]` idvecs before the verification loops; replace `isuid()` with O(1) hash lookup.
+
+**hurd-0002 (MEDIUM):** `libports/interrupt-on-notify.c:63` — `ports_interrupt_rpc_on_notification`
+
+Linear scan of `_ports_notifications` (global linked list) on every RPC notification registration while holding `_ports_lock`. O(N_notifications) per call. Called per RPC in `libdiskfs`/`libtrivfs`. Fix: hash `_ports_notifications` by `(port, what)`.
+
+**hurd-0003 (MEDIUM):** `libports/interrupt-notified-rpcs.c:31` — `ports_interrupt_notified_rpcs`
+
+Same `_ports_notifications` linear scan, fired on every dead-name event (every watched port death). Port deaths cascade. Same fix as hurd-0002 — shared root cause, single structural change fixes both.
+
+**hurd-0004 (LOW-MEDIUM):** `proc/info.c:65` + `proc/mgt.c:88` — `check_owner` → `check_uid`
+
+Double UID array linear scan on every `kill()`, `waitpid()`, `ptrace()`, task port request. O(nuids²). N is small in practice (≤64), but fires on every proc server IPC. Fix: sort + binary search.
+
+**hurd-0005 (MEDIUM):** `libports/bucket-iterate.c:41` — `_ports_bucket_class_iterate`
+
+Global `_ports_htable` scan filtered by class. Source comment reads: *"This is obscenely ineffecient. ihash and ports need to cooperate more closely to do it efficiently."* O(total_ports) even for a single-class iteration. Fix: per-class member list in `port_class`.
+
+**hurd-0006 (MEDIUM):** `libshouldbeinlibc/idvec.c:139` — `idvec_merge_ids`
+
+O(k) linear scan per incoming ID during idvec merge. O(k²) total when merging two idvecs of size k. Called from `S_auth_makeauth` — compounds hurd-0001. Fix: sort + binary search or temporary hash set.
 
 ## Contact
 
 GNU Hurd mailing list: `bug-hurd@gnu.org`
-GNU Savannah: https://savannah.gnu.org/projects/hurd/
+Savannah project: https://savannah.gnu.org/projects/hurd/
 
 ## Status
 
-Scan queued 2026-04-04. Defect files pending.
+Defects confirmed 2026-04-04. Patches in progress. hurd-0002 and hurd-0003 share a fix. hurd-0001 and hurd-0006 compound each other on the `auth_makeauth` path.