Executive brief
relibc is a C standard library implementation used in the Redox operating system. The seekdir() function, which repositions a directory stream to a previously saved location, can be crashed by passing a negative offset value that the function does not properly validate, causing the process to panic and become unavailable.
Technical details
The vulnerability is a panic-on-invalid-input flaw in the seekdir() function (src/header/dirent/mod.rs) in relibc. The function calls .expect() on a type conversion operation without first validating that the input offset parameter is non-negative. An attacker can invoke seekdir() with a negative c_long offset value, which causes the .try_into() conversion to fail and trigger the expect() panic, resulting in a denial of service. The attack vector is local; the attacker must be able to execute code that calls the vulnerable function. A fix is available in GitLab merge request 980 (commit 61f42d6b).
Affected products
- Redox OS relibc commit 61f42d and earlier
Timeline
- 2026-08-28: disclosed
- 2026: patched: Fix available in merge request 980