QA-14: monad_event_ring_try_copy Leaks Stale Descriptor Content on Failure

monad-qa-14-event-ring-copy-leak

Summary

monad_event_ring_try_copy copies a descriptor into the caller-provided output buffer before checking whether the sequence number is valid.

Vulnerability details

1
inline bool monad_event_ring_try_copy(
2
    struct monad_event_ring const *event_ring, uint64_t seqno,
3
    struct monad_event_descriptor *event)
4
{
5
    if (__builtin_expect(seqno == 0, 0)) {
6
        return false;
7
    }
8
    struct monad_event_descriptor const *const ring_event =
9
        &event_ring->descriptors[(seqno - 1) & event_ring->desc_capacity_mask];
10
    *event = *ring_event;
11
    uint64_t const ring_seqno =
12
        __atomic_load_n(&ring_event->seqno, __ATOMIC_ACQUIRE);
13
    if (__builtin_expect(ring_seqno != seqno, 0)) {
14
        return false;
15
    }
16
    return true;
17
}

Impact

When validation fails and the function returns false, the output buffer can still contain stale descriptor metadata from an unrelated event.

Recommendation

Validate the sequence number first, then copy the descriptor only on success.