2.5 KiB
NetBSD — CWE-407 Disclosure Brief
2026-04-05 · 4 confirmed defects · All patched
Finding
Four O(N²) / O(N×k) algorithmic complexity defects across NetBSD's network interface address lookup, kernel credential group membership, multicast sysctl traversal, and PCI resource enumeration. All are linear scan patterns in hot paths where hash tables, binary search, or single-pass traversal should be used.
The Defects
netbsd-0001 (HIGH): sys/net/if.c — ifa_ifwithaddr, ifa_ifwithnet, ifa_ifwithdstaddr
IFNET_READER_FOREACH (I interfaces) × IFADDR_READER_FOREACH (A addresses). O(I×A) per call. Called from ip_dooptions() inside ip_input() — per-packet on source-routed traffic. At I=50, A=20: 1,000 comparisons per packet. Fix: per-AF hash table ifaddr_hashtab[] keyed on address bytes → ifaddr*. O(1) lookup.
netbsd-0002 (MEDIUM): sys/kern/kern_auth.c — kauth_cred_uucmp, kauth_cred_ismember_gid
kauth_cred_uucmp loops over uuc->cr_ngroups (N) calling kauth_cred_ismember_gid for each, which linearly scans cred->cr_groups (M). O(N×M) total. Called from vnode permission checks and NFS credential matching. Fix: sort cr_groups on credential creation; use bsearch in kauth_cred_ismember_gid. O(N log M) total.
netbsd-0003 (LOW): sys/netinet/in.c — in_multicast_sysctl
Triple nested loop (interfaces × addresses × multicast groups) traversed twice — once for buffer size estimation, once to copy. Double-pass multiplies O(I×A×G) work by 2. Fix: single-pass with dynamic buffer growth; eliminate re-traversal.
netbsd-0004 (LOW): sys/dev/pci/pciconf.c — pci_resource_is_reserved, setup_iowins, setup_memwins
pci_resource_is_reserved() does LIST_FOREACH over pciconf_resource_reservations (O(R)) called per window. Plus insertion-sort in get_io_desc/get_mem_desc. O(N×R) + O(N²) for sort during PCI enumeration. Fix: sorted array + bsearch for O(log R) reservation lookup; qsort once at end instead of insertion sort.
Contact
NetBSD security: security-alert@NetBSD.org
NetBSD tech mailing list: tech-net@NetBSD.org
Project: https://www.netbsd.org/
Status
All 4 defects patched as of 2026-04-05. Patches: netbsd-0001-ifa-ifwithaddr-hash.patch, netbsd-0002-kauth-cred-ismember-bsearch.patch, netbsd-0003-in-multicast-sysctl-single-pass.patch, netbsd-0004-pci-resource-bsearch.patch.
netbsd-0001 and dragonflybsd-0001 share the same root cause — the ifa_ifwithaddr family of functions uses nested interface+address walks in both kernels.