⬢ DragonFlyBSD Kernel Audit
DF-2703 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-2703",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Latent marshalling defect, proven by scripted struct-vs-assignment audit: vop_mountctl (sys/kern/vfs_vopops.c:1300-1308) never sets ap.a_vp (an uninitialized kernel-stack struct vnode*), and vop_markatime/vop_allocate (vfs_vopops.c:1327-1330, 1349-1353) never set the vestigial a_op int. Every current handler derives state from a_head.a_ops->head.vv_mount and ignores the uninitialized fields, so there is no runtime symptom on a stock kernel; any future handler reading ap->a_vp would dereference attacker-influenced stack garbage. Phase V skipped per contract (Low hardening; nothing observable to reproduce).",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-2703/VERDICT.md (scripted marshalling diff + full handler survey)",
    "sys/kern/vfs_vopops.c:1292-1315 vop_mountctl assignments omit ap.a_vp",
    "sys/sys/vfsops.h:433-443 struct vop_mountctl_args declares a_vp as last field",
    "sys/kern/vfs_syscalls.c:1277-1283 mountctl is SYSCAP_RESTRICTEDROOT-gated"
  ],
  "kernel_refs": [
    "sys/kern/vfs_vopops.c:1292",
    "sys/kern/vfs_vopops.c:1300",
    "sys/kern/vfs_vopops.c:1320",
    "sys/kern/vfs_vopops.c:1342",
    "sys/sys/vfsops.h:433",
    "sys/sys/vfsops.h:445",
    "sys/sys/vfsops.h:452",
    "sys/kern/vfs_default.c:1301"
  ],
  "poc_changes": "no PoC built: latent defect, no observable behavior",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Phase V skipped deliberately: Low-severity hardening finding, root-gated for the pointer field (mountctl) and int-only for the user-reachable ops. Static proof is complete (all in-tree handlers surveyed, none read the uninitialized fields). Fix is 3 lines; also consider deleting the dead a_op fields.",
  "recommended_fix": "Initialize ap.a_vp = vp in vop_mountctl and ap.a_op = 0 in vop_markatime/vop_allocate (or remove the unused a_op fields from the structs in sys/sys/vfsops.h)."
}