java-topology/whitepaper/outreach/hurd.md

GNU Hurd — CWE-407 Disclosure Brief

2026-04-04 · 5 confirmed defects · All patched

Finding

Five O(N²) / O(N×k) algorithmic complexity defects across GNU Hurd's auth server, libports notification and iteration infrastructure, and libshouldbeinlibc ID vector library. All are linear scan patterns in IPC-critical hot paths where hash or sorted structures should be used. (hurd-0004 was investigated and found to be a clean scan — check_owner calls check_uid once, not in a loop.)

The Defects

hurd-0001 (HIGH): auth/auth.c:162 — S_auth_makeauth

Four nested loops over nauths × n{e,a}uids/n{e,a}gids. Each isuid()/groupmember() call expands to idvec_contains() → idvec_tail_contains() — a pointer-walk linear scan over every UID in the auth handle.

for (i = 0; i < neuids; i++) {
  for (j = 0; j < nauths; j++)
    if (auths[j] && isuid(euids[i], auths[j]))  // O(k) scan per call
      { has_it = 1; break; }
}
// repeated for nauids, negids, nagids

O(N×M×k) total. Called on every exec, setuid, auth_makeauth RPC — the spine of Hurd's privilege model. Fix: build a uid_t hash set from the union of all auths[] idvecs before the verification loops; replace isuid() with O(1) hash lookup.

hurd-0002 (MEDIUM): libports/interrupt-on-notify.c:63 — ports_interrupt_rpc_on_notification

Linear scan of _ports_notifications (global linked list) on every RPC notification registration while holding _ports_lock. O(N_notifications) per call. Called per RPC in libdiskfs/libtrivfs. Fix: hash _ports_notifications by (port, what).

hurd-0003 (MEDIUM): libports/interrupt-notified-rpcs.c:31 — ports_interrupt_notified_rpcs

Same _ports_notifications linear scan, fired on every dead-name event (every watched port death). Port deaths cascade. Same fix as hurd-0002 — shared root cause, single structural change fixes both.

hurd-0005 (MEDIUM): libports/bucket-iterate.c:41 — _ports_bucket_class_iterate

Global _ports_htable scan filtered by class. Source comment reads: "This is obscenely ineffecient. ihash and ports need to cooperate more closely to do it efficiently." O(total_ports) even for a single-class iteration. Fix: per-class member list in port_class. Patched.

hurd-0006 (MEDIUM): libshouldbeinlibc/idvec.c:139 — idvec_merge_ids

O(k) linear scan per incoming ID during idvec merge. O(k²) total when merging two idvecs of size k. Called from S_auth_makeauth — compounds hurd-0001. Fix: sort + binary search or temporary hash set.

Contact

GNU Hurd mailing list: bug-hurd@gnu.org Savannah project: https://savannah.gnu.org/projects/hurd/

Status

All 5 defects patched as of 2026-04-04. Patches: patch/0001-CWE-407-hurd-0001-hurd-0006-*.patch (auth.c + idvec.c), patch/0002-CWE-407-hurd-0002-hurd-0003-*.patch (libports notify htable), patch/0003-CWE-407-hurd-0005-per-class-port-list.patch (class iteration).

hurd-0002 and hurd-0003 share a fix. hurd-0001 and hurd-0006 compound each other on the auth_makeauth path.