2.4 KiB
linux: CWE-407 deeper scan — net/core, kernel/ CLEAN
Subsystems scanned
| Subsystem | Files | Verdict |
|---|---|---|
net/core/dev.c |
for_each_netdev, adjacency lists | CLEAN |
net/core/fib_rules.c |
rule_find, rule_exists, list_for_each_entry | CLEAN |
net/core/sock.c |
proto_register, assign_proto_idx | CLEAN |
kernel/groups.c |
groups_search, supplementary GIDs | CLEAN |
kernel/user_namespace.c |
mappings_overlap, uid/gid extents | BOUNDED |
kernel/sched/topology.c |
find_pd, for_each_cpu perf domains | CLEAN |
kernel/sched/core.c |
for_each_cpu + smt_mask, cpumask_andnot | CLEAN |
kernel/workqueue.c |
for_each_pwq, for_each_pool | CLEAN |
kernel/notifier.c |
raw_notifier_call_chain | CLEAN |
Notes
net/core/dev.c — __dev_alloc_name
Outer for_each_netdev with inner netdev_for_each_altname scans a bitmap of
used slots — sets a bit per slot using bitmap_zalloc(max_netdevices).
Not a membership test inside a growing list; the bitmap is reset fresh each call.
CLEAN.
net/core/fib_rules.c — rule_find, rule_exists
Both do a single sequential pass over ops->rules_list. The three sequential
passes in fib_nl_newrule (ctarget scan, pref-order scan, unresolved-rules
update) are not nested — each is O(R) standalone. CLEAN.
kernel/user_namespace.c — mappings_overlap
Called in outer loop over lines in the UID/GID map file; inner loop checks
overlap against already-accepted extents. Technically O(E²) but bounded by
UID_GID_MAP_MAX_EXTENTS = 340. Peak: 340² = 115,600 comparisons on one
write() call. Not network-facing; attacker must have a user namespace.
Below threshold for a new defect ticket; noted here for completeness.
kernel/sched/topology.c — find_pd
find_pd() walks a short linked list of perf_domain objects (O(P), where P =
number of distinct CPU performance domains — typically 1–4 on real hardware)
inside for_each_cpu(i, cpu_map). Worst case O(C×P) but P is structurally
bounded by hardware topology, not attacker-controlled. CLEAN.
net/ipv4/, fs/, mm/ — NOT IN SPARSE CLONE
The sparse clone does not include net/ipv4/, fs/, or mm/. Those
subsystems require a fresh clone or broader sparse-checkout configuration.
Conclusion
No new CWE-407 defects found in the scanned kernel subsystems beyond
linux-0001..0008. The sparse clone limits further scanning of net/ipv4/,
fs/, and mm/.