⬢ DragonFlyBSD Kernel Audit
DF-2774 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-2774",
  "title": "mountlist_exists()/vq_vptomp(): stale vp->v_pfsmp after nullfs unmount — wrong-mount VFS accounting & quota enforcement, struct mount UAF window",
  "verdict": "reproduced",
  "reproduced": true,
  "impact": "cross-mount accounting corruption + wrong-mount quota enforcement (EDQUOT) / struct-mount UAF window (bounded by zone type-stability)",
  "confidence": "certain",
  "kernel_refs": [
    "sys/kern/vfs_mount.c:692-708",
    "sys/kern/vfs_mount.c:399-405",
    "sys/kern/vfs_cache.c:1386-1389",
    "sys/kern/vfs_quota.c:421-433",
    "sys/kern/vfs_quota.c:149-172",
    "sys/kern/vfs_vnops.c:325-326",
    "sys/kern/vfs_vopops.c:487-496",
    "sys/kern/vfs_syscalls.c:1040-1117"
  ],
  "reproduce": {
    "build": "no compile; enable vfs.quota_enabled=1 in /boot/loader.conf and reboot; pw useradd -n qa -m -s /bin/sh; copy poc.sh to /root",
    "run": "sh /root/poc.sh   (as root; unprivileged file activity via su -m qa)",
    "expected_baseline": "TEST1: 'dd: stdout: Disc quota exceeded' (RC=1) on the unquota'd lower tmpfs; TEST2: vquota show /mnt/alias2 -> total: 18446744073709543424, limit = 10",
    "expected_patched": "TEST1_RC=0 (4096 bytes transferred); alias2 stays total: 0, limit = 10; alias-path accounting still works (4096 on the nullfs mount)"
  },
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "poc.sh",
    "build.sh",
    "run.sh",
    "run.log",
    "run.2.log",
    "run.fix.log",
    "build.log",
    "env.txt",
    "fix.diff",
    "verdict.json",
    "manifest.json"
  ]
}