russell@unturf.com
db4e0cc498
dnsmasq: option_filter() O(N²) duplicate elimination in src/dhcp-common.c. Two nested loops over dhcp_opt list called per DHCP reply. Fix: 256-entry bitmap keyed by 1-byte option code. 23/23 PASS, 25-50x measured ratio. MOADs 0002/0004/0005 CLEAN; MOAD-0003 N/A (single-threaded). systemd: dbus-cgroup.c IPIngressFilterPath/IPEgressFilterPath setter calls strv_contains() inside for(;;) loop — O(N²) on D-Bus property writes. Fix: HashSet pre-populated before loop. 17/17 PASS, 250x at N=500. MOADs 0002/0003/0004/0005 CLEAN (single-threaded sd-event, no key logging).
49 lines
2.1 KiB
Markdown
49 lines
2.1 KiB
Markdown
# systemd 5-MOAD scan — 2026-03-31
|
||
|
||
Source: https://github.com/systemd/systemd (depth=1)
|
||
Focus: src/core/, src/resolve/, src/cryptsetup/, src/login/
|
||
|
||
Prior defects in this directory:
|
||
- systemd-0001: strv_extend_strv dedup O(N²) (src/basic/strv.c) — HIGH
|
||
- systemd-0002: unit_file_get_list states filter O(U×S) (src/shared/install.c) — MEDIUM
|
||
|
||
## MOAD-0001 (CWE-407): DEFECT — systemd-0003
|
||
|
||
`src/core/dbus-cgroup.c` BPF filter path setter: `strv_contains(*filters, path)`
|
||
called inside a `for(;;)` loop reading D-Bus array elements for
|
||
`IPIngressFilterPath=` / `IPEgressFilterPath=` properties. O(N²) total for N
|
||
paths. See `systemd-0003-dbus-cgroup-bpf-filter-strv-dedup.patch`.
|
||
|
||
Same pattern also appears in `src/core/load-fragment.c`
|
||
`config_parse_ip_filter_bpf_progs()`. Both sites are LOW-MEDIUM severity
|
||
(config/property-write path, not hot packet path).
|
||
|
||
Other candidates reviewed and found LOW severity or too small in practice:
|
||
- `src/core/device.c` LIST_FOREACH + strv_contains(aliases, d->path): called
|
||
on udev hotplug events. aliases list is small (udev SYSTEMD_ALIAS values).
|
||
- `src/core/transaction.c` nested LIST_FOREACH: not a membership test, just
|
||
pairwise conflict checking over job sets.
|
||
|
||
## MOAD-0002 (Intertangle): CLEAN (architectural note)
|
||
|
||
The `Manager` struct (`src/core/manager.h`, 672 lines) is a god object holding
|
||
all systemd state. This is intentional and well-known. The subsystems (device,
|
||
mount, swap, service, etc.) all reference it. No novel coupling to patch.
|
||
Marked CLEAN.
|
||
|
||
## MOAD-0003 (Leaked Context): CLEAN
|
||
|
||
systemd is a single-threaded sd-event loop. No `thread_local`, `__thread`, or
|
||
`pthread_getspecific` found in `src/core/` or `src/resolve/`. CLEAN.
|
||
|
||
## MOAD-0004 (CWE-312 Logged Secret): CLEAN
|
||
|
||
Reviewed `src/cryptsetup/cryptsetup.c` for LUKS passphrase, volume key, and
|
||
TPM key material in log calls. Found only device names and error messages in
|
||
`log_debug`/`log_info`/`log_warning` — no passphrase values, no key bytes,
|
||
no token secrets. CLEAN.
|
||
|
||
## MOAD-0005 (Thundering Herd): CLEAN
|
||
|
||
systemd is a single-threaded sd-event loop. No concurrent hashmap/set access.
|
||
CLEAN.
|