52 lines
2.5 KiB
Markdown
52 lines
2.5 KiB
Markdown
# UNDF: UNDF-2026-000000144
|
||
# linux: CWE-407 deeper scan — net/core, kernel/ CLEAN
|
||
|
||
## Subsystems scanned
|
||
|
||
| Subsystem | Files | Verdict |
|
||
|-----------|-------|---------|
|
||
| `net/core/dev.c` | for_each_netdev, adjacency lists | CLEAN |
|
||
| `net/core/fib_rules.c` | rule_find, rule_exists, list_for_each_entry | CLEAN |
|
||
| `net/core/sock.c` | proto_register, assign_proto_idx | CLEAN |
|
||
| `kernel/groups.c` | groups_search, supplementary GIDs | CLEAN |
|
||
| `kernel/user_namespace.c` | mappings_overlap, uid/gid extents | BOUNDED |
|
||
| `kernel/sched/topology.c` | find_pd, for_each_cpu perf domains | CLEAN |
|
||
| `kernel/sched/core.c` | for_each_cpu + smt_mask, cpumask_andnot | CLEAN |
|
||
| `kernel/workqueue.c` | for_each_pwq, for_each_pool | CLEAN |
|
||
| `kernel/notifier.c` | raw_notifier_call_chain | CLEAN |
|
||
|
||
## Notes
|
||
|
||
### net/core/dev.c — `__dev_alloc_name`
|
||
Outer `for_each_netdev` with inner `netdev_for_each_altname` scans a bitmap of
|
||
used slots — sets a bit per slot using `bitmap_zalloc(max_netdevices)`.
|
||
Not a membership test inside a growing list; the bitmap is reset fresh each call.
|
||
CLEAN.
|
||
|
||
### net/core/fib_rules.c — `rule_find`, `rule_exists`
|
||
Both do a single sequential pass over `ops->rules_list`. The three sequential
|
||
passes in `fib_nl_newrule` (ctarget scan, pref-order scan, unresolved-rules
|
||
update) are not nested — each is O(R) standalone. CLEAN.
|
||
|
||
### kernel/user_namespace.c — `mappings_overlap`
|
||
Called in outer loop over lines in the UID/GID map file; inner loop checks
|
||
overlap against already-accepted extents. **Technically O(E²)** but bounded by
|
||
`UID_GID_MAP_MAX_EXTENTS = 340`. Peak: 340² = 115,600 comparisons on one
|
||
`write()` call. Not network-facing; attacker must have a user namespace.
|
||
Below threshold for a new defect ticket; noted here for completeness.
|
||
|
||
### kernel/sched/topology.c — `find_pd`
|
||
`find_pd()` walks a short linked list of `perf_domain` objects (O(P), where P =
|
||
number of distinct CPU performance domains — typically 1–4 on real hardware)
|
||
inside `for_each_cpu(i, cpu_map)`. Worst case O(C×P) but P is structurally
|
||
bounded by hardware topology, not attacker-controlled. CLEAN.
|
||
|
||
### net/ipv4/, fs/, mm/ — NOT IN SPARSE CLONE
|
||
The sparse clone does not include `net/ipv4/`, `fs/`, or `mm/`. Those
|
||
subsystems require a fresh clone or broader sparse-checkout configuration.
|
||
|
||
## Conclusion
|
||
|
||
No new CWE-407 defects found in the scanned kernel subsystems beyond
|
||
linux-0001..0008. The sparse clone limits further scanning of `net/ipv4/`,
|
||
`fs/`, and `mm/`.
|