# netbsd-0002 — CWE-407: kauth_cred_uucmp / kauth_cred_ismember_gid — O(N×M) group scan

**Severity:** MEDIUM
**File:** `sys/kern/kern_auth.c`
**Functions:** `kauth_cred_uucmp`, `kauth_cred_ismember_gid`
**CWE:** CWE-407 Algorithmic Complexity

## Defect

`kauth_cred_uucmp` loops over `uuc->cr_ngroups` (N) calling `kauth_cred_ismember_gid` for each, which linearly scans `cred->cr_groups` (M). O(N×M) total. Called from vnode permission checks and NFS credential matching.

```c
/* in kauth_cred_uucmp */
for (i = 0; i < uuc->cr_ngroups; i++) {
    if (!kauth_cred_ismember_gid(cred, uuc->cr_groups[i], &rv))
        return EPERM;
}

/* in kauth_cred_ismember_gid */
for (i = 0; i < cred->cr_ngroups; i++) {   // O(M) linear scan
    if (cred->cr_groups[i] == gid)
        return 0;
}
```

**Complexity:** O(N×M) where N = `cr_ngroups` in incoming uucred, M = `cr_ngroups` in target cred.

## Scale

N=32 groups × M=32 groups = 1,024 comparisons per vnode permission check. NFS credential matching calls this on every file access in cross-credential mounts.

## Fix

Sort `cr_groups` on credential creation; use `bsearch` in `kauth_cred_ismember_gid`. O(N log M) total. `cr_groups` is immutable after credential creation so sort cost is paid once.