russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

1.9 KiB

Raw Blame History

Kronos — CWE-312 Disclosure Brief (kronos-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One CWE-312 (cleartext storage of sensitive information) defect in Kronos's netlink emulation. The NetlinkHandleUARTData() function logs the internet login password response verbatim during dial-up emulation.

The Defect

kronos-0002 (PATCHED — LOW): yabause/src/utils/src/netlink.c:549

if (NetlinkArea->connectstatus == NL_CONNECTSTATUS_LOGIN2 &&
    NetlinkArea->modemstate == NL_MODEMSTATE_DATA &&
    val == 0x0D)
{
    NetlinkArea->connectstatus = NL_CONNECTSTATUS_LOGIN3;
    NETLINK_LOG("password response: %s",
                NetlinkArea->inbuffer+NetlinkArea->inbufferstart);  // plaintext password
}

The password entered during dial-up login emulation is logged verbatim via NETLINK_LOG.

Impact

Kronos (Yabause) emulates the Sega Saturn's NetLink modem for online play. While this is emulation of a legacy system, the password could be a real credential if a user enters one during netlink testing. The fix follows defense-in-depth principles.

The Fix

Replace the verbatim password log with a redacted marker:

// Before
NETLINK_LOG("password response: %s", NetlinkArea->inbuffer+NetlinkArea->inbufferstart);
// After
NETLINK_LOG("password response: [REDACTED]");

Patch

Fix available: defects/kronos-0002/patch/kronos-0002.patch

Single-file patch in yabause/src/utils/src/netlink.c. One-line change.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference.
Assess severity — logs plaintext password during netlink emulation.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Kronos team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

1.9 KiB Raw Blame History