java-topology/docs/tickets/netbsd-0002.md

netbsd-0002 — CWE-407: kauth_cred_uucmp / kauth_cred_ismember_gid — O(N×M) group scan

Severity: MEDIUM File: sys/kern/kern_auth.c Functions: kauth_cred_uucmp, kauth_cred_ismember_gid CWE: CWE-407 Algorithmic Complexity

Defect

kauth_cred_uucmp loops over uuc->cr_ngroups (N) calling kauth_cred_ismember_gid for each, which linearly scans cred->cr_groups (M). O(N×M) total. Called from vnode permission checks and NFS credential matching.

/* in kauth_cred_uucmp */
for (i = 0; i < uuc->cr_ngroups; i++) {
    if (!kauth_cred_ismember_gid(cred, uuc->cr_groups[i], &rv))
        return EPERM;
}

/* in kauth_cred_ismember_gid */
for (i = 0; i < cred->cr_ngroups; i++) {   // O(M) linear scan
    if (cred->cr_groups[i] == gid)
        return 0;
}

Complexity: O(N×M) where N = cr_ngroups in incoming uucred, M = cr_ngroups in target cred.

Scale

N=32 groups × M=32 groups = 1,024 comparisons per vnode permission check. NFS credential matching calls this on every file access in cross-credential mounts.

Fix

Sort cr_groups on credential creation; use bsearch in kauth_cred_ismember_gid. O(N log M) total. cr_groups is immutable after credential creation so sort cost is paid once.