// disclosure & hardening
Security.
Two things live on this page. First, what MayteraOS actually enforces against exploitation today: address-space randomization, stack canaries, position-independent executables, a hardened syscall boundary, and TLS certificate validation, each stated as enforced, partial or planned rather than claimed wholesale. Second, the advisory log below: every reachable memory-safety defect found by the project's own fuzzing and AddressSanitizer harnesses, with the builds it affected and the build that fixed it.
Hardening & exploit mitigations
Enforced today: position-independent executables and a whole-image writable-plus-executable (W^X) gate across every shipped app and game binary; per-process load-address randomization drawn from the kernel's CSPRNG; stack canaries in the kernel and across the userland app fleet, also seeded from the kernel CSPRNG rather than a raw timestamp; SMEP where the CPU supports it; all 132 pointer-taking syscalls validated at a single dispatcher chokepoint, enforced by a build-failing lint; and real TLS certificate chain and signature verification (including CertificateVerify), not just parsing.
Partial or planned, stated plainly rather than left implied: SMAP is fully wired but deliberately left disabled until a remaining set of kernel-side user-memory accesses are moved onto the safe copy primitives; the filesystem permission layer is implemented and self-tested but inert as shipped, because the desktop still auto-logs in as an administrator account; kernel base randomization (KASLR) is assessed but not built, blocked on the kernel's current identity-mapped page tables; and the security event log is not yet append-only or tamper-evident.
Every claim above has the evidence behind it, plus the gaps, on the Hardening & Mitigations page: what was measured, how, and the commands to re-check it yourself against a downloaded image.
Advisories
Product line: MayteraOS v1.95.x. The meaningful version identifier is the build number, shown on the desktop as “v1.95.0 (build NNN)”. Every advisory below is witnessed against the reference implementation (which over-reads or over-writes on a crafted input) and confirmed fixed (the identical input is confined) in an offline differential harness. AddressSanitizer is the usual witness, but it is not sufficient everywhere and we do not claim it is: one read in 0006 lands past ASan’s redzone in valid heap and needs a guard page, 0008’s write claim needed a page-fault error code, and 0001 cannot be witnessed at all. The evidence basis is stated per advisory rather than claimed across the board. Severity uses an informal High / Medium scale, weighted by write-vs-read impact and reachability (remote exposure ranks above network/LAN, which ranks above a local file or disk).
| ID | Component | Type (CWE) | Severity | Attack vector / reachability | Affected builds | Patched in |
|---|---|---|---|---|---|---|
| MAYTERA-SEC-2026-0001 | ext2 directory parse (fs/ext2.c: ext2_lookup /
ext2_dirblock_find) |
CWE-125 out-of-bounds read |
Medium | Local: reading a crafted ext2 image with malformed directory rec_len /
name_len heap over-reads on any lookup. Fixed by the
#476 bounds guards on all four ext2 directory walkers. This is the one
advisory whose vulnerable code is no longer recoverable (the fix predates every
snapshot we retained), so it cannot be re-witnessed; it rests on the kernel’s own
version log, and we label the evidence as such rather than overstate it. |
≤ build 793 | 794 |
| MAYTERA-SEC-2026-0002 | DHCP reply parse (net/dhcp.c: dhcp_parse) |
CWE-125 out-of-bounds read |
Medium | Network (LAN): a spoofed runt DHCP OFFER drives the option TLV walk past the packet buffer. | ≤ build 805 | 806 |
| MAYTERA-SEC-2026-0003 | ELF loader validate (exec/elf.c: elf_validate /
calculate_load_bounds) |
CWE-190 → CWE-787 (+CWE-125) integer overflow leading to OOB write |
High | Local file: a crafted ELF (oversized p_filesz underflow plus undersized
e_phentsize) yields an out-of-bounds heap write on load. |
≤ build 807 | 808 |
| MAYTERA-SEC-2026-0004 | FAT / VFAT LFN reassembly (fs/fat.c: fat_dir_step) |
CWE-787 out-of-bounds write |
High | Local, reachable from Ring 3 via SYS_READDIR: a crafted FAT
long-file-name overruns the name buffer (260 vs. 256), an out-of-bounds heap write. |
≤ build 809 | 810 |
| MAYTERA-SEC-2026-0005 | PNG decoder (gui/png.c: IHDR size math + BGRA convert loop) |
CWE-190 → CWE-787 (+CWE-125) integer overflow leading to OOB write |
High | Untrusted image: a crafted PNG whose IHDR width/height wrap the 32-bit size math into
an undersized allocation, after which the BGRA convert loop (plain C, not the
defilter step) writes out of bounds. Working proof-of-concept:
width=0x40000004, RGBA, height 1. What confines it is the Rust IHDR
parser’s checked arithmetic, which rejects the image before the write is reached.
Reachable from the browser’s <img> rendering, Files previews and
downloads. Not wallpapers, which are all BMP. |
≤ build 812 | 813 |
| MAYTERA-SEC-2026-0006 | JPEG decoder (gui/jpeg.c: SOF0 / SOS / DHT header parse) |
CWE-787 (intra-object) + CWE-125 buffer overflow inside the object, and out-of-bounds reads |
High | Untrusted image: a crafted JPEG with three unvalidated header fields. An unvalidated
quantization-table index reads 12,800 bytes past a 256-byte object. An unvalidated DC/AC
Huffman-table index reads 22,528 bytes past an 8,192-byte object; that read lands in
valid heap past AddressSanitizer’s redzone, so ASan reports it clean and it
is witnessed with a guard page instead. An unclamped DHT count sum then writes 4,080
bytes past its table: in the shipping code that write stays inside the enclosing
9,760-byte allocation, so it is intra-object corruption (it smashes the Huffman validity
flags that drive decoding) rather than an out-of-allocation write. Reachable from album
art, the browser’s <img> rendering and Files previews. |
≤ build 813 | 814 |
| MAYTERA-SEC-2026-0007 | TLS handshake parse (net/tls/tls.c: TLS 1.2 handshake-message
loop) |
CWE-125 out-of-bounds read |
HighRemote, pre-auth | Remote, pre-authentication: a malicious or on-path server’s first flight declares an oversized handshake length; the plaintext ServerHello loop reads out of bounds (measured: 4094 bytes past a 5-byte body). Runs on every outbound HTTPS handshake. | ≤ build 815 | 816 |
| MAYTERA-SEC-2026-0008 | HTTP chunked decode (net/https.c: https_dechunk) |
CWE-190 → CWE-787 (+CWE-125) integer overflow leading to OOB write |
HighRemote | Remote: a malicious or compromised HTTPS origin the browser visits (or a compromised API or update endpoint) sends a chunked response whose hex chunk-size is near 232; a 32-bit length clamp wraps, skipping the bounds check, and the following memory copy writes far outside the response body buffer. Reachable on any chunked HTTPS response, including LLM API replies, browser page loads, the updater, and widget feeds. | ≤ build 816 | 817 |
| MAYTERA-SEC-2026-0009 | AAC / M4A parser (media/aac.c: mp4_parse) |
CWE-125 out-of-bounds read |
Medium | Local, reachable from Ring 3 via SYS_PLAY_WAV: a crafted
.m4a / .mp4 file’s sample-table walk
(stsz / stco / co64 / stsc
chunk-offset entries) reads past the file buffer on inflated entry counts, with no
per-entry bound. |
≤ build 818 | 819 |
| MAYTERA-SEC-2026-0010 | HTTP/2 frame parser (net/http2.c: http2_get padding
branch / frame framing) |
CWE-125 → CWE-476 out-of-bounds read leading to NULL pointer dereference |
HighRemote, pre-auth | Remote, pre-authentication: a malicious or compromised HTTPS site the browser visits negotiates HTTP/2 (h2 via ALPN) and sends a single DATA or HEADERS frame with length 0 and the PADDED flag set; the client reads the pad-length byte off a payload buffer that was never allocated for a zero-length frame, causing a NULL/out-of-bounds dereference, a page fault, and a whole-OS denial of service. One frame, no authentication, low complexity. | ≤ build 821 | 822 |
| MAYTERA-SEC-2026-0011 | Extended-attribute parser (fs/xattr.c: on-disk entry-walk shared by
getxattr / listxattr / setxattr /
remove) |
CWE-125 out-of-bounds read |
Medium | Local: a crafted or corrupt FAT filesystem image whose /.xattr/*.xat
block declares a name_len / value_len / attr_count
that runs past the kmalloc’d file buffer; any
getxattr / listxattr (sys_getxattr) on the
associated file walks the entries trusting those on-disk lengths and over-reads the
heap, causing a kernel info-leak or denial of service. The walk validated only the
block magic, not the per-entry lengths. |
≤ build 822 | 823 |
| MAYTERA-SEC-2026-0012 | NFS3 client read (net/nfs.c: nfs_read reply
data length) |
CWE-787 out-of-bounds write |
HighRemote | Remote: a malicious or compromised NFS server that the client mounts and reads from
(nfs://host/export) returns a READ reply whose declared data length is larger
than the amount the client requested. The client copies that server-controlled length into
the caller’s read buffer without clamping it to the buffer size, overflowing the
destination on the heap. The transfer was bounded only against the receive buffer (source),
never against the destination, so a single crafted reply corrupts kernel memory. Fixed by
clamping the delivered length to the requested count. |
≤ build 823 | 824 |
| MAYTERA-SEC-2026-0013 | JPEG decoder (gui/jpeg.c: build_huffman Huffman
table build) |
CWE-787 out-of-bounds write |
High | A crafted JPEG whose Huffman table (DHT) declares a non-canonical set of code lengths, for example 255 one-bit codes where the code space allows at most two. The decoder built the lookup table without checking that the declared code lengths can actually exist, writing roughly 259 KB past the table with attacker-chosen bytes. Reachable from an ordinary Ring 3 application through image decoding, so any picture opened by the browser, the Files previews, the image viewer or printing could trigger it. Fixed in plain C by enforcing that the declared code lengths satisfy the Kraft inequality (used as an oracle independent of the implementation: the C, the Rust and the mathematics agree across 300,000 generated tables) and bounding the symbol index. The guard is independent of which implementation is selected at build time. This defect was original to the decoder and predates the Rust port; the port narrowed how it could be reached but did not create it. | ≤ build 825 | 826 |
| MAYTERA-SEC-2026-0014 | IPv4 receive path (net/ip.c: ip_handle payload
length) |
CWE-191 → CWE-125 integer underflow to out-of-bounds read |
HighRemote | Remote and unauthenticated, from any host on the same network: no IP address is required, because a system still awaiting DHCP accepts any frame and a broadcast destination is accepted regardless. The receive path checked the header length and the declared total length against the frame, but never that the total length was at least the header length, so the subtraction underflowed. A crafted 60-byte frame yields a payload length of 65,496, which was then handed to every protocol handler. Measured rather than inferred: ICMP, UDP and TCP were each observed being called with the bogus length, and the resulting over-reads were witnessed directly in the real handlers. Fixed in plain C with a one-line check that repairs all three protocols at the root, independent of build-time flags. | ≤ build 825 | 826 |
How to update
Notes
- An advisory is only filed for a defect proven reachable: the C reference implementation demonstrably over-reads or over-writes on a crafted input, and the fix is proven to confine the identical input. Ports of already-correctly-bounded code (for example inflate/DEFLATE, ARP, DNS, URL parsing, ExFAT, BMP) are defense-in-depth only and are not listed here, since no reachable defect was found.
- Every advisory is fixed at the source, in the shipping code path, so the fix holds regardless of which implementation a given build selects. Where a defect had more than one possible confinement, the fix that actually protects the shipping build is the one credited in the table.
- On the counts above: 0006’s write is out of bounds of its Huffman table but stays inside the enclosing allocation in the shipping code (intra-object corruption); the other five out-of-bounds writes leave their allocation entirely. We count it as a write and say so here rather than adjust the number quietly.
- By reachability: four remote issues (0007 TLS pre-authentication, 0008 HTTP chunked-transfer decode and 0010 HTTP/2 frame parsing, all pre-auth, plus 0012 a malicious NFS server the client mounts and reads), one network/LAN issue (0002), two untrusted-image issues (0005, 0006), and five local file/disk issues (0001, 0003, 0004, 0009, 0011, the last two reachable from Ring-3 via the play-audio and get/list-xattr syscalls respectively).