/* * harness.c - Deterministic userspace replication of the unvalidated resident * attribute data-offset OOB read in ntfs_attrtontvattr() * (sys/vfs/ntfs/ntfs_subr.c:557-564). * * ROOT CAUSE (confirmed by source trace of sys/vfs/ntfs/ntfs_subr.c): * 554: } else { // resident attribute * 555: vap->va_compressalg = 0; * 557: vap->va_datalen = rap->a_r.a_datalen; // u16 from disk, NO bound * 558: vap->va_allocated = rap->a_r.a_datalen; * 561: vap->va_datap = kmalloc(vap->va_datalen, M_NTFSRDATA, M_WAITOK); * 563: memcpy(vap->va_datap, * 564: (caddr_t) rap + rap->a_r.a_dataoff, // <-- a_dataoff u16 UNCHECKED * rap->a_r.a_datalen); // <-- a_datalen u16 UNCHECKED * * rap is a struct attr * pointing into mfrp, the MFT record buffer: * mfrp = kmalloc(ntfs_bntob(ntmp->ntm_bpmftrec), M_TEMP, M_WAITOK); // line 263 * typically 1024 or 4096 bytes. The on-disk u16 a_dataoff/a_datalen are * trusted without any bounds check, so a crafted image with a_dataoff past * the record boundary makes memcpy read past mfrp into adjacent M_TEMP slab * heap. The leaked bytes land in vap->va_datap and are later exposed to * userspace via ntfs_readntvattr_plain():1594 uiomove(vap->va_datap+roff, * rsize, uio). * * WHY A HARNESS * ------------ * The live trigger (mount_ntfs on a crafted image) reaches the vulnerable * memcpy at mount time during ntfs_loadntnode(), but whether the OOB read * manifests as a panic or a silent leak depends on what byte pattern lives * in the adjacent slab chunk (determined by prior kernel allocations). This * harness makes the OOB read DETERMINISTIC by placing a guard page * (PROT_NONE) immediately after the record buffer, so any read past the * buffer end faults (SIGSEGV) — proving the primitive exists regardless of * slab layout. It also demonstrates that the proposed fix (bounding * a_dataoff+a_datalen against the record size) eliminates the OOB read. * * Build: cc -O2 -o harness harness.c * Run: ./harness {clean|oob_dataoff} [apply_fix] * Exit: 0 = memcpy completed within bounds (clean, or fix rejected bad input) * 2 = SIGSEGV caught -> OOB read past record (proof of the bug) */ #define _GNU_SOURCE #include #include #include #include #include #include #include /* * Mirror the exact struct layouts from sys/vfs/ntfs/ntfs.h. * * struct attrhdr { // 16 bytes * u_int32_t a_type; * u_int32_t reclen; * u_int8_t a_flag; * u_int8_t a_namelen; * u_int8_t a_nameoff; * u_int8_t reserved1; * u_int8_t a_compression; * u_int8_t reserved2; * u_int16_t a_index; * }; * struct attr { * struct attrhdr a_hdr; * union { * struct { // resident (a_S_r) * u_int16_t a_datalen; * u_int16_t reserved1; * u_int16_t a_dataoff; * u_int16_t a_indexed; * } a_S_r; * ... * } a_S; * }; * #define a_r a_S.a_S_r */ struct attrhdr { uint32_t a_type; uint32_t reclen; uint8_t a_flag; uint8_t a_namelen; uint8_t a_nameoff; uint8_t reserved1; uint8_t a_compression; uint8_t reserved2; uint16_t a_index; } __attribute__((packed)); struct attr_resident { struct attrhdr hdr; uint16_t a_datalen; /* offset 16 */ uint16_t reserved1; /* offset 18 */ uint16_t a_dataoff; /* offset 20 -- THE BUG: unchecked */ uint16_t a_indexed; /* offset 22 */ } __attribute__((packed)); #define REC_BYTES 1024 /* classic MFT record size; also test 4096 */ #define REC_BYTES_BIG 4096 /* matches the sibling image geometry */ #define NTFS_AF_INRUN 0x01 /* ---- signal handling so we can catch the OOB SIGSEGV cleanly ---- */ static sigjmp_buf jb; static volatile int got_sig; static void segv_handler(int sig) { (void)sig; got_sig = SIGSEGV; siglongjmp(jb, 1); } /* * Mirror of ntfs_attrtontvattr() resident path, lines 554-565. * rap = pointer to the attribute inside the MFT record buffer * rec_size = size of the MFT record buffer (mfrp allocation) * rec_base = start of the MFT record buffer (for bounds computation) * * Returns: 0 = memcpy within bounds; 1 = OOB detected by fix (rejected); * exits via SIGSEGV if the buggy path reads past the guard page. */ static int resident_memcpy_buggy(struct attr_resident *rap, uint8_t *rec_base, int rec_size, uint8_t *out, int out_sz) { uint16_t datalen = rap->a_datalen; /* line 557 */ uint16_t dataoff = rap->a_dataoff; /* unchecked */ /* line 561: kmalloc(datalen) -> out (caller-provided) */ int n = (datalen < out_sz) ? datalen : out_sz; /* line 563-564: memcpy(out, rap + dataoff, datalen) -- THE BUG */ memcpy(out, (uint8_t *)rap + dataoff, n); return 0; } /* * The proposed fix: validate that (rap + a_dataoff + a_datalen) does not * exceed the MFT record buffer boundary before the memcpy. */ static int resident_memcpy_fixed(struct attr_resident *rap, uint8_t *rec_base, int rec_size, uint8_t *out, int out_sz) { uint16_t datalen = rap->a_datalen; uint16_t dataoff = rap->a_dataoff; uintptr_t rap_addr = (uintptr_t)rap; uintptr_t rec_end = (uintptr_t)rec_base + rec_size; /* NEW: validate a_dataoff+a_datalen fits within the record buffer */ if (rap_addr + dataoff + datalen > rec_end) return 1; /* EINVAL: reject the malformed attribute */ int n = (datalen < out_sz) ? datalen : out_sz; memcpy(out, (uint8_t *)rap + dataoff, n); return 0; } /* * Build a synthetic resident attribute inside the record buffer. * mode "clean": a_dataoff points to valid data within the record. * mode "oob_dataoff": a_dataoff pushed past the record end so memcpy * reads into the guard page. */ static struct attr_resident * fill_record(uint8_t *rec, int rec_size, const char *mode, int attr_off) { memset(rec, 0xA5, rec_size); /* fill with sentinel (non-zero residue) */ struct attr_resident *rap = (struct attr_resident *)(rec + attr_off); rap->hdr.a_type = 0x80; /* NTFS_A_DATA */ rap->hdr.a_flag = 0; /* resident */ rap->hdr.reclen = 64; if (strcmp(mode, "clean") == 0) { /* legitimate resident attribute: data right after the header */ rap->a_datalen = 32; /* 32 bytes of data */ rap->a_dataoff = 24; /* data starts at hdr+24 (offset 24) */ /* write some known data at rap+24 */ memset((uint8_t *)rap + 24, 'D', 32); } else if (strcmp(mode, "oob_dataoff") == 0) { /* BUG: a_dataoff pushed past the record end. * rap is at attr_off within the record; set dataoff so that * rap + dataoff + datalen exceeds rec_base + rec_size. */ rap->a_datalen = 64; /* push the read target past the buffer end: * rap_addr + dataoff + 64 > rec_base + rec_size * dataoff > rec_size - attr_off - 64 */ rap->a_dataoff = (uint16_t)(rec_size - attr_off); /* start AT the end */ } else { fprintf(stderr, "unknown mode '%s'\n", mode); exit(3); } return rap; } int main(int argc, char **argv) { if (argc < 2) { fprintf(stderr, "usage: %s {clean|oob_dataoff} [apply_fix] [recsize]\n", argv[0]); fprintf(stderr, " recsize: 1024 (default) or 4096\n"); return 3; } const char *mode = argv[1]; int apply_fix = (argc >= 3 && strcmp(argv[2], "apply_fix") == 0); int rec_size = (argc >= 4) ? atoi(argv[3]) : REC_BYTES; if (rec_size != REC_BYTES && rec_size != REC_BYTES_BIG) { fprintf(stderr, "recsize must be 1024 or 4096\n"); return 3; } long pagesz = 4096; size_t mapsz = ((size_t)rec_size + pagesz - 1) & ~((size_t)pagesz - 1); /* Allocate rec_size writable bytes + one guard page right after. */ uint8_t *base = mmap(NULL, mapsz + pagesz, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (base == MAP_FAILED) { perror("mmap"); return 3; } if (mprotect(base + mapsz, pagesz, PROT_NONE) != 0) { perror("mprotect"); return 3; } /* Place rec at the END of the writable region so the guard page is * immediately after byte rec_size-1 (truest mirror of a slab chunk). */ uint8_t *rec = base + mapsz - rec_size; /* attribute starts at offset 56 within the record (after a typical * FILE header + fixup array), mirroring fr_attroff. */ int attr_off = 56; struct attr_resident *rap = fill_record(rec, rec_size, mode, attr_off); /* install SIGSEGV handler */ struct sigaction sa, oldsa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = segv_handler; sigemptyset(&sa.sa_mask); sa.sa_flags = 0; sigaction(SIGSEGV, &sa, &oldsa); uint8_t out[256]; memset(out, 0, sizeof(out)); got_sig = 0; int rc; if (sigsetjmp(jb, 1) == 0) { if (apply_fix) rc = resident_memcpy_fixed(rap, rec, rec_size, out, sizeof(out)); else rc = resident_memcpy_buggy(rap, rec, rec_size, out, sizeof(out)); } else { rc = 2; /* SIGSEGV -> OOB read past the guard page */ } sigaction(SIGSEGV, &oldsa, NULL); const char *verdict; switch (rc) { case 0: verdict = "memcpy within bounds (clean)"; break; case 1: verdict = "FIX REJECTED malformed attribute (EINVAL) - OOB prevented"; break; case 2: verdict = "SIGSEGV -> OOB READ past record into guard page " "(= adjacent slab heap in kernel): LEAK CONFIRMED"; break; default: verdict = "unknown"; break; } printf("mode=%-12s apply_fix=%-3d recsz=%-4d attr_off=%d " "a_dataoff=0x%04x a_datalen=%-3u -> rc=%d %s\n", mode, apply_fix, rec_size, attr_off, rap->a_dataoff, rap->a_datalen, rc, verdict); /* For the clean case, show the copied data to prove it works normally. */ if (rc == 0 && strcmp(mode, "clean") == 0) { printf(" copied %u bytes: first 8 = ", rap->a_datalen); for (int i = 0; i < 8 && i < (int)rap->a_datalen; i++) printf("%02x ", out[i]); printf("(expected 44 44 ... = 'D' sentinel)\n"); } return (rc == 0 || rc == 1) ? 0 : rc; }