⬢ DragonFlyBSD Kernel Audit
DF-2658 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-2658",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Not verified on the guest (status untested): triggering requires a forged/mismatched same-key chain pair with differing bytes AND modify_tid across cluster columns, which needs a block-level DATA-chain forger (radix/mtid/CRC/freemap surgery) beyond the current h2common.py tooling; the multi-hour build-out was deprioritized in favor of the DF-2657 root-cause fix validation. The code defect itself is certain from line-accurate reading: hammer2_sync_resize uses hammer2_getradix(chain->bytes) (the OLD size) making hammer2_chain_resize a guaranteed no-op (chain.c:1363-1366 early-returns when nbytes==obytes), after which bcopy(data, chain->data, chain->bytes) at synchro.c:1041/1049 runs with data = gdata(focus) of focus->bytes - focus smaller => OOB read persisted to media (info leak into synced file content); focus larger => silent truncation with inconsistent vradix metadata (synchro.c:954); focus embedded dirent (bytes==0) => NULL-source bcopy panic. hammer2_chain_cmp compares only key+keybits (chain.c:97-118) so size-mismatched same-key chains with differing mtid reach the path.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-2658/README.md (root-cause with path:line, fix sketch, PoC plan)",
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_synchro.c:939",
    "sys/vfs/hammer2/hammer2_synchro.c:941",
    "sys/vfs/hammer2/hammer2_synchro.c:954",
    "sys/vfs/hammer2/hammer2_synchro.c:1041",
    "sys/vfs/hammer2/hammer2_synchro.c:1049",
    "sys/vfs/hammer2/hammer2_chain.c:97",
    "sys/vfs/hammer2/hammer2_chain.c:1363"
  ],
  "poc_changes": "n/a (no seed PoC existed; audit-time discovery)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Filed from pass-2 audit of hammer2_synchro.c. Reachability preconditions: root-mounted/attacker-forged cluster images or naturally diverged columns after partial write failures; severity Medium (kernel OOB read -> persisted info leak; NULL-bcopy panic variant). Companion insert path (synchro.c:761-765) is size-safe because it creates with focus->bytes.",
  "recommended_fix": "nradix = hammer2_getradix(focus->bytes) (rounded up to hold focus->bytes), bound the copies by min(chain->bytes, focus->bytes), and explicitly handle the embedded-dirent (bytes==0) transition."
}