A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in …
提示
摘要
A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c copies the dld_ioc_macprop_t ioctl header in once to read its pr_valsize field, sizes and allocates a kernel heap buffer from that value, and then copies the full request in a second time from the same unprivileged user address. A concurrent thread can enlarge pr_…
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判 · 自动通道
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
Lint 边界警告 (2)
以下是本次研判 lint 阶段发现的非阻塞性警告（如引用 URL 未在白名单内）。这些不影响漏洞条目可用性，仅为透明度披露（参 DR-002）。
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://illumos.org/issues/18020 -
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://illumos.topicbox.com/groups/developer/T923147fae854a738-M03c29e1be33dac2a5e3d9535/18020-double-copyin-of-dldioc-consumers
数据来源
- NVD DATABASE
原始链接
- https://github.com/illumos/illumos-gate/commit/6959feb5b430411a4809b06c53dcdb42fb525eac
- https://illumos.org/issues/18020
- https://illumos.topicbox.com/groups/developer/T923147fae854a738-M03c29e1be33dac2a5e3d9535/18020-double-copyin-of-dldioc-consumers
时间线
- nvd_ingest NVD