russell@unturf.com db4e0cc498 systemd+dnsmasq: 5-MOAD scan; dnsmasq-0001 + systemd-0003 MOAD-0001 defects

dnsmasq: option_filter() O(N²) duplicate elimination in src/dhcp-common.c.
Two nested loops over dhcp_opt list called per DHCP reply. Fix: 256-entry
bitmap keyed by 1-byte option code. 23/23 PASS, 25-50x measured ratio.
MOADs 0002/0004/0005 CLEAN; MOAD-0003 N/A (single-threaded).

systemd: dbus-cgroup.c IPIngressFilterPath/IPEgressFilterPath setter calls
strv_contains() inside for(;;) loop — O(N²) on D-Bus property writes. Fix:
HashSet pre-populated before loop. 17/17 PASS, 250x at N=500.
MOADs 0002/0003/0004/0005 CLEAN (single-threaded sd-event, no key logging).

2026-03-31 21:34:28 -04:00

2.1 KiB

Raw Blame History

systemd 5-MOAD scan — 2026-03-31

Source: https://github.com/systemd/systemd (depth=1) Focus: src/core/, src/resolve/, src/cryptsetup/, src/login/

Prior defects in this directory:

systemd-0001: strv_extend_strv dedup O(N²) (src/basic/strv.c) — HIGH
systemd-0002: unit_file_get_list states filter O(U×S) (src/shared/install.c) — MEDIUM

MOAD-0001 (CWE-407): DEFECT — systemd-0003

src/core/dbus-cgroup.c BPF filter path setter: strv_contains(*filters, path) called inside a for(;;) loop reading D-Bus array elements for IPIngressFilterPath= / IPEgressFilterPath= properties. O(N²) total for N paths. See systemd-0003-dbus-cgroup-bpf-filter-strv-dedup.patch.

Same pattern also appears in src/core/load-fragment.c config_parse_ip_filter_bpf_progs(). Both sites are LOW-MEDIUM severity (config/property-write path, not hot packet path).

Other candidates reviewed and found LOW severity or too small in practice:

src/core/device.c LIST_FOREACH + strv_contains(aliases, d->path): called on udev hotplug events. aliases list is small (udev SYSTEMD_ALIAS values).
src/core/transaction.c nested LIST_FOREACH: not a membership test, just pairwise conflict checking over job sets.

MOAD-0002 (Intertangle): CLEAN (architectural note)

The Manager struct (src/core/manager.h, 672 lines) is a god object holding all systemd state. This is intentional and well-known. The subsystems (device, mount, swap, service, etc.) all reference it. No novel coupling to patch. Marked CLEAN.

MOAD-0003 (Leaked Context): CLEAN

systemd is a single-threaded sd-event loop. No thread_local, __thread, or pthread_getspecific found in src/core/ or src/resolve/. CLEAN.

MOAD-0004 (CWE-312 Logged Secret): CLEAN

Reviewed src/cryptsetup/cryptsetup.c for LUKS passphrase, volume key, and TPM key material in log calls. Found only device names and error messages in log_debug/log_info/log_warning — no passphrase values, no key bytes, no token secrets. CLEAN.

MOAD-0005 (Thundering Herd): CLEAN

systemd is a single-threaded sd-event loop. No concurrent hashmap/set access. CLEAN.

2.1 KiB Raw Blame History Unescape Escape