The following issues were found

Kernel/ACPI/MultiProcessorParser.cpp
1 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 100 Column: 48 CWE codes: 126 

              {
    Vector<u8> pci_bus_ids;
    for (auto& entry : m_bus_entries) {
        if (!strncmp("PCI   ", entry.bus_type, strlen("PCI   ")))
            pci_bus_ids.append(entry.bus_id);
    }
    return pci_bus_ids;
}

Reported by FlawFinder.

Userland/Utilities/test_env.cpp
1 issues
getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 15 Column: 20 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them 

              
static void assert_env(const char* name, const char* value)
{
    char* result = getenv(name);
    if (!result) {
        perror("getenv");
        outln("(When reading value for '{}'; we expected '{}'.)", name, value);
        VERIFY(false);
    }

Reported by FlawFinder.

Kernel/Devices/MemoryDevice.cpp
1 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 30 Column: 33 CWE codes: 120 20 

              {
}

KResultOr<size_t> MemoryDevice::read(FileDescription&, u64, UserOrKernelBuffer&, size_t)
{
    TODO();
}

void MemoryDevice::did_seek(FileDescription&, off_t)

Reported by FlawFinder.

Kernel/Devices/HID/MouseDevice.h
1 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 26 Column: 31 CWE codes: 120 20 

                  virtual ~MouseDevice() override;

    // ^CharacterDevice
    virtual KResultOr<size_t> read(FileDescription&, u64, UserOrKernelBuffer&, size_t) override;
    virtual bool can_read(const FileDescription&, size_t) const override;
    virtual KResultOr<size_t> write(FileDescription&, u64, const UserOrKernelBuffer&, size_t) override;
    virtual bool can_write(const FileDescription&, size_t) const override { return true; }

    // ^HIDDevice

Reported by FlawFinder.

Kernel/Devices/HID/MouseDevice.cpp
1 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 27 Column: 32 CWE codes: 120 20 

                  return !m_queue.is_empty();
}

KResultOr<size_t> MouseDevice::read(FileDescription&, u64, UserOrKernelBuffer& buffer, size_t size)
{
    VERIFY(size > 0);
    size_t nread = 0;
    size_t remaining_space_in_buffer = static_cast<size_t>(size) - nread;
    ScopedSpinLock lock(m_queue_lock);

Reported by FlawFinder.

Userland/Utilities/chgrp.cpp
1 issues
chown - This accepts filename arguments; if an attacker can move those files, a race condition results.
Security

Line: 49 Column: 14 CWE codes: 362
Suggestion: Use fchown( ) instead 

                      new_gid = group->gr_gid;
    }

    int rc = chown(path, -1, new_gid);
    if (rc < 0) {
        perror("chgrp");
        return 1;
    }

Reported by FlawFinder.

Userland/Utilities/chmod.cpp
1 issues
chmod - This accepts filename arguments; if an attacker can move those files, a race condition results.
Security

Line: 122 Column: 13 CWE codes: 362
Suggestion: Use fchmod( ) instead 

                      /* found the minimal CNF by The Quine–McCluskey algorithm and use it */
        mode_t mode = mask.get_applying_mask()
            | (current_access.st_mode & ~mask.get_removal_mask());
        if (chmod(argv[i++], mode) != 0) {
            perror("chmod");
        }
    }

    return 0;

Reported by FlawFinder.

Userland/Utilities/chown.cpp
1 issues
chown - This accepts filename arguments; if an attacker can move those files, a race condition results.
Security

Line: 67 Column: 14 CWE codes: 362
Suggestion: Use fchown( ) instead 

                      }
    }

    int rc = chown(argv[2], new_uid, new_gid);
    if (rc < 0) {
        perror("chown");
        return 1;
    }

Reported by FlawFinder.

Kernel/Devices/HID/KeyboardDevice.h
1 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 28 Column: 31 CWE codes: 120 20 

                  virtual ~KeyboardDevice() override;

    // ^CharacterDevice
    virtual KResultOr<size_t> read(FileDescription&, u64, UserOrKernelBuffer&, size_t) override;
    virtual bool can_read(const FileDescription&, size_t) const override;
    virtual KResultOr<size_t> write(FileDescription&, u64, const UserOrKernelBuffer&, size_t) override;
    virtual bool can_write(const FileDescription&, size_t) const override { return true; }

    // ^HIDDevice

Reported by FlawFinder.

Userland/Utilities/comm.cpp
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 66 Column: 46 CWE codes: 362 

                      if (path == "-") {
            file = Core::File::standard_input();
        } else {
            auto file_or_error = Core::File::open(path, Core::OpenMode::ReadOnly);
            if (file_or_error.is_error()) {
                warnln("Failed to open file{} '{}': {}", file_number, path, file_or_error.error());
                return false;
            }
            if (Core::File::is_directory(path)) {

Reported by FlawFinder.