Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

klange/toaruos

              master @ d37a3a7
            

Fixes

CVEs

HIGH

Peak severity

34.3%

Coverage

Highlights

Denial of Service: 20 prior fixes. Scrutinize any change in this area.

kernel/sys/syscall.c: most-fixed (33 issues). Treat as high-risk during review.

52 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Privilege Escalation: The dynamic linker previously honored the LD_LIBRARY_PATH environment variable when executing setuid binaries, allowing local users to inject arbitrary code and escalate privileges to root. This was tracked as CVE-2019-13046.

Memory Protection Bypass: A vulnerability in the set-heap system call (TOARU_SYS_FUNC_SETHEAP) lacked virtual address bounds checking, allowing processes to map arbitrary kernel memory into user-space, resulting in root access. This was tracked as CVE-2019-13047.

Memory Corruption: System call implementations (such as sys_write, sys_read, sys_execve, and readlink) frequently suffered from missing or flawed user-space pointer validation, allowing malicious user-space applications to cause kernel-mode memory corruption.