Description

In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized strnlen loop loads one word ahead before checking the aligned boundary: REG_L t1, SZREG(t0) // load next word addi t0, t0, SZREG // advance orc.b t1, t1 bgeu t0, t4, 4f // boundary check AFTER load where t4 = (s + count) & -SZREG. When s is aligned and count is a multiple of SZREG, t4 equals s + count and the loop loads a full word starting at exactly s + count. If s + count falls on a page boundary with the next page unmapped, this faults. Fix by computing the aligned boundary from the last valid byte (s + count - 1) instead of s + count. This makes the loop stop at the word containing the last valid byte rather than potentially loading the word after it. The count == 0 case is already handled by the beqz early exit. Also add a pre-loop guard (bgeu t0, t4) for the case where all valid bytes fit within the first word. With the adjusted boundary, t4 can equal t0, and entering the loop with stale register state from the first-word processing would produce incorrect results. The final minu clamp ensures the result is still correct when the last loaded word extends past s + count - 1 within the same aligned word.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-08-26T15:16:54.160Z",
  "pubdate": "2026-08-26T15:16:54.160Z",
  "executiveSummary": "The Linux kernel's RISC-V ZBB-optimized strnlen implementation contains an out-of-bounds memory access vulnerability due to improper boundary checking during word-aligned memory loads.\nThe vulnerability is categorized as an out-of-bounds read (CWE-125), which may lead to kernel panics or potential information disclosure under specific memory alignment conditions.\nThis flaw resides in the assembly-level string handling routines for RISC-V architectures utilizing the ZBB (Bit-Manipulation) extension.\nAn attacker capable of controlling the inputs to strnlen (e.g., via syscalls that process user-supplied buffers) could trigger a page fault by forcing the loop to perform a speculative read across an unmapped memory page boundary.\nExploitation requires the target buffer to be placed at a specific offset relative to a page boundary, specifically when the buffer length and alignment cause the read pointer to advance into an unmapped address space before the loop termination condition is evaluated.\nSuccessful exploitation results in a kernel oops, causing a denial of service (DoS) for the affected system, though it does not inherently grant code execution.",
  "technicalDetails": "The vulnerability originates in the RISC-V ZBB-optimized strnlen function, where the assembly loop logic performs an eager word load before validating the loop boundary. In the original implementation, the boundary register t4 is calculated as (s + count) & -SZREG, where SZREG represents the register width (typically 8 bytes).\nThe execution flow proceeds as follows: the loop executes 'REG_L t1, SZREG(t0)', loading the next word from memory into a register, followed by 'addi t0, t0, SZREG' to advance the pointer, and finally checks the boundary using 'bgeu t0, t4, 4f'.\nWhen the input string pointer 's' is word-aligned and the 'count' argument is a multiple of SZREG, the variable t4 effectively equals 's + count'. Consequently, the instruction 'REG_L t1, SZREG(t0)' performs a load at 's + count', which is exactly the byte immediately following the valid range. If this address crosses into an unmapped memory page, the CPU triggers a page fault exception, leading to a kernel panic.\nThe flawed logic fails to account for the speculative nature of the load instruction within the loop context. Because the boundary check occurs after the load, the kernel attempts to access memory outside the intended buffer scope.\nTo resolve this, the boundary calculation must be adjusted to align with the last valid byte of the buffer, specifically using (s + count - 1). This adjustment ensures the loop terminates upon reaching the word that contains the final valid byte, preventing the load instruction from advancing to the subsequent word.\nFurthermore, the original implementation lacked a pre-loop guard for cases where the buffer length is smaller than the register width (SZREG). The fix introduces a 'bgeu t0, t4' check before entering the loop to ensure that the register state correctly reflects the boundary condition, particularly after the adjusted logic where t4 could equal the current pointer address t0. The integration of a 'minu' clamp serves as an additional safeguard, ensuring the result remains accurate even if the final loaded word contains bits corresponding to the null terminator or end-of-count condition within the same aligned word boundary."
}