34 lines
1.2 KiB
Markdown
34 lines
1.2 KiB
Markdown
# netbsd-0002 — CWE-407: kauth_cred_uucmp / kauth_cred_ismember_gid — O(N×M) group scan
|
||
|
||
**Severity:** MEDIUM
|
||
**File:** `sys/kern/kern_auth.c`
|
||
**Functions:** `kauth_cred_uucmp`, `kauth_cred_ismember_gid`
|
||
**CWE:** CWE-407 Algorithmic Complexity
|
||
|
||
## Defect
|
||
|
||
`kauth_cred_uucmp` loops over `uuc->cr_ngroups` (N) calling `kauth_cred_ismember_gid` for each, which linearly scans `cred->cr_groups` (M). O(N×M) total. Called from vnode permission checks and NFS credential matching.
|
||
|
||
```c
|
||
/* in kauth_cred_uucmp */
|
||
for (i = 0; i < uuc->cr_ngroups; i++) {
|
||
if (!kauth_cred_ismember_gid(cred, uuc->cr_groups[i], &rv))
|
||
return EPERM;
|
||
}
|
||
|
||
/* in kauth_cred_ismember_gid */
|
||
for (i = 0; i < cred->cr_ngroups; i++) { // O(M) linear scan
|
||
if (cred->cr_groups[i] == gid)
|
||
return 0;
|
||
}
|
||
```
|
||
|
||
**Complexity:** O(N×M) where N = `cr_ngroups` in incoming uucred, M = `cr_ngroups` in target cred.
|
||
|
||
## Scale
|
||
|
||
N=32 groups × M=32 groups = 1,024 comparisons per vnode permission check. NFS credential matching calls this on every file access in cross-credential mounts.
|
||
|
||
## Fix
|
||
|
||
Sort `cr_groups` on credential creation; use `bsearch` in `kauth_cred_ismember_gid`. O(N log M) total. `cr_groups` is immutable after credential creation so sort cost is paid once.
|