Skip to content

fix security vulner#7191

Merged
hk-gwak merged 1 commit intoSamsung:masterfrom
hk-gwak:fix-vulner-security
Mar 27, 2026
Merged

fix security vulner#7191
hk-gwak merged 1 commit intoSamsung:masterfrom
hk-gwak:fix-vulner-security

Conversation

@hk-gwak
Copy link
Copy Markdown
Collaborator

@hk-gwak hk-gwak commented Mar 18, 2026

Fix the reported security vulnerabilities related to network

  1. select() does not validate nfds against the configured descriptor limit and uses it to size and populate a heap-allocated pollfd array, enabling integer-overflow allocation and heap memory corruption with attacker-controlled nfds and fd_set contents.
  2. The LWNL driver accepts user-provided messages containing raw pointers and passes them directly into netmgr request handlers without validating lengths or copying data. In protected builds, an unprivileged task can write to /dev/lwnl and cause kernel memory writes through attacker-controlled pointers.
  3. The GETHOSTBYNAME request handler writes into a caller-supplied struct hostent without validating buffer sizes or pointer safety. In protected builds, an unprivileged task can supply invalid pointers and trigger kernel memory writes.

Copy link
Copy Markdown
Contributor

@giwon-nam giwon-nam left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

보안 취약점 수정 건입니다.

@hk-gwak hk-gwak merged commit 15b1e21 into Samsung:master Mar 27, 2026
21 checks passed
hk-gwak added a commit that referenced this pull request Mar 30, 2026
hk-gwak added a commit that referenced this pull request Mar 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants