Date: 2026-08-17
Auditor: Automated baseline + manual review
Status: Initial audit — findings revalidated against source

BoubisOS is a hobby/educational operating system with no security hardening. It is designed for learning and experimentation, not for running untrusted code.

Key architectural limitations:

• No hardware-enforced user/kernel isolation: User processes can modify their own page tables.
• No ASLR: All addresses are deterministic.
• No NX bit: All pages are executable.
• No capability-based security: IPC ports are identified by small integers.
• No cryptographic randomness: Stack canary is a static constant.

These are accepted architectural limitations for a hobby OS, not bugs.

• Severity: HIGH
• Location: kernel/syscall.c, syscall_dispatch()
• Status: PARTIALLY_FIXED
• Description: Syscalls SYS_WRITE, SYS_TASK_LAUNCH, and SYS_TASK_RUN accepted user-space pointers without validating they fall within the user address range.
• Fix Applied: Added user_pointer_valid(), user_buffer_valid(), and user_string_valid() helpers. Applied validation to SYS_WRITE, SYS_TASK_LAUNCH, and SYS_TASK_RUN.
• Remaining Risk: Other syscalls (e.g., SYS_IPC) still accept user pointers via ipc_service(). Full validation requires kernel-side page table walks.
• Regression Test: Host-side test validates the helper logic.

• Severity: MEDIUM
• Location: kernel/core/sched.c
• Status: ACCEPTED_LIMITATION
• Description: The stack canary (0xDEADBEEFCAFEBABE) is a compile-time constant, not randomized per-task. An attacker who knows the value can forge it.
• Fix: Per-task random canary would require an entropy source, which this OS lacks. Documented as a limitation.
• Mitigation: Canary is checked on every context switch, which detects accidental corruption even if it doesn't prevent intentional attacks.

• Severity: MEDIUM
• Location: kernel/core/sched.c, task_wait()
• Status: FIXED
• Description: task_wait() spun forever if the target task never exited.
• Fix Applied: Added TASK_WAIT_TIMEOUT_TICKS (100,000 ticks ≈ 1000 seconds). Returns -1 on timeout.
• Regression Test: Logic tested implicitly via timeout behavior.

• Severity: MEDIUM
• Location: kernel/core/sched.c, task_create()
• Status: FIXED
• Description: malloc(TASK_STACK_SIZE) return was not checked. If malloc failed, the canary write at address 0 would crash the kernel.
• Fix Applied: Added NULL check on malloc; returns -1 on allocation failure.

• Severity: LOW
• Location: servers/vfs/vfs_server.c, handle_request() VFS_MOUNT case
• Status: FIXED
• Description: Server read only 1 byte for the 4-byte port integer. Ports >= 256 were silently truncated.
• Fix Applied: Changed (int)req->data[256] to memcpy(&fs_port, req->data + 256, sizeof(fs_port)).
• Regression Test: tests/unit/test_vfs_mount.c verifies round-trip encoding for ports 0-65535.

• Severity: MEDIUM
• Location: userspace/programs/browser.c, decode_entities()
• Status: FIXED
• Description: val = val * base + d could overflow for very long numeric character references.
• Fix Applied: Added overflow guard: if (val > (INT_MAX - d) / base) { val = INT_MAX; break; }
• Regression Test: Host-side test verifies bounded numeric entity parsing.

• Severity: MEDIUM
• Location: userspace/programs/browser.c, resolve_url()
• Status: FIXED
• Description: sprintf(p, "http://%s:%d", cur_host, cur_port) could overflow the output buffer if hostname or formatted URL exceeded buffer size.
• Fix Applied: Replaced with snprintf() and added bounds checks. Also fixed missing slash when cur_path has no directory component.
• Regression Test: Host-side test verifies bounded output and URL resolution.

• Severity: LOW
• Location: userspace/programs/browser.c, parse_url()
• Status: FIXED
• Description: Port number parsing could overflow for very long digit sequences.
• Fix Applied: Added overflow guard clamping to 65535.
• Regression Test: Host-side test verifies port 99999 → 65535.

• Severity: LOW
• Location: libc/stdlib.c, kernel/memory/heap.c
• Status: FIXED
• Description: nmemb * size could wrap for large allocation requests.
• Fix Applied: Added if (nmemb > SIZE_MAX / size) return NULL; before multiplication.
• Regression Test: Host-side test verifies overflow detection.

• Severity: HIGH
• Location: userspace/drivers/e1000.c, libc/http.c
• Status: OPEN
• Description: Network packet parsing trusts length fields without validating they fit within the receive buffer.
• Fix Planned: Add bounds checks before every memcpy/memcmp in packet handlers. Deferred to Phase 10+ due to code complexity.
• Impact: Malformed packets could cause out-of-bounds reads.

• Severity: HIGH
• Location: userspace/usb/ehci.c, userspace/usb/uhci.c
• Status: OPEN
• Description: USB descriptor parsing does not validate bLength before accessing descriptor fields.
• Fix Planned: Validate bLength >= sizeof(standard_descriptor) and bLength <= remaining_buffer before field access.
• Impact: Malicious USB devices could trigger out-of-bounds reads.

• Severity: LOW
• Location: kernel/core/sched.c, load_elf_segments()
• Status: OPEN
• Description: ELF segment loading does not check for integer overflow in p_vaddr + p_memsz or p_offset + p_filesz.
• Fix Planned: Add overflow checks before page table operations.
• Impact: Crafted ELF files could cause incorrect memory mappings.

• Severity: MEDIUM
• Location: kernel/core/ipc.c, ipc_send() / ipc_recv()
• Status: OPEN
• Description: ipc_send() and ipc_recv() accept user-provided ipc_msg * without validating the pointer. The syscall dispatch passes the pointer directly from userspace.
• Fix Planned: Validate message pointer in syscall dispatch before passing to IPC.
• Impact: Userspace could pass a kernel pointer, causing privilege escalation.

• Severity: MEDIUM (Architectural)
• Location: kernel/memory/vmm.c, vmm_create_user_pml4()
• Status: ACCEPTED_LIMITATION
• Description: User processes can modify their own page tables because page table pages are mapped with user-accessible permissions.
• Fix: Would require mapping page tables only in kernel space, which is a major architectural change.
• Impact: A malicious userspace process could map arbitrary physical memory.

• Severity: MEDIUM
• Location: kernel/arch/amd64/interrupts/idt_asm.asm
• Status: OPEN
• Description: The ISR stubs make assumptions about stack frame layout that may not hold for all interrupt types. The isr_err and isr_noerr macros have different stack layouts but the error code handling is inconsistent.
• Fix Planned: Review and standardize ISR frame handling.
• Impact: Could cause crashes or incorrect error handling on certain interrupts.

1. Complete S-001: Validate ALL user pointers in syscall dispatch, not just the most obvious ones.
2. Address S-010 and S-011: Network and USB input validation are critical for any future network-facing or USB-connected use.
3. Document S-014 clearly: Anyone using BoubisOS should understand that userspace processes have full memory access.
4. Add more regression tests: Every fixed vulnerability should have a corresponding test.

End of security audit.