⬢ DragonFlyBSD Kernel Audit
DF-2955 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-2955",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "fattime2timespec() computes tsp->tv_sec += DAY * day as a 32-bit unsigned product (int DAY x unsigned day), which wraps mod 2^32 for every FAT date from 2106-02-08 (day 49711) through 2107-12-31. Verified three ways on the guest: (1) a full-range round-trip harness shows exactly 692 failing days starting 2106-02-08, all read-path; (2) on a real msdosfs mount, utimes(2107-12-31) stats back as 1971-11-23 22:31:44 while the on-disk directory entry holds a perfectly valid MDate=0xff9f; (3) the same reproduces unprivileged (uid 1001, -u 1001 mount). Impact is silent timestamp corruption (integrity) only: the wrapped value is a canonical timespec, no memory-safety effect. Fix (time_t)DAY cast validated on a rebuilt X86_64_GENERIC kernel: both cases then MATCH exactly.",
  "exploit_chain": "",
  "evidence": [
    "run.log lines for W1/W2: requested 4295030400/4354750800 vs stat 63104 (1970-01-01 17:31:44) / 59783504 (1971-11-23 22:31:44), both = requested - 2^32",
    "findentry.log: W1 MDate bytes 48 fc (0xfc48 = 2106-02-08), W2 9f ff (0xff9f = 2107-12-31) - valid on-disk dates, decoder-only bug",
    "harness_guest.log section A: first round-trip failure 2106-02-08, 692 failing days of 46699",
    "poc_unpriv.log: uid=1001 user reproduces on -u 1001 mounted fs, no root",
    "poc_fixed.log: patched kernel -> W1/W2 MATCH exactly"
  ],
  "kernel_refs": [
    "sys/kern/subr_fattime.c:251",
    "sys/kern/subr_fattime.c:219",
    "sys/vfs/msdosfs/msdosfs_vnops.c:251",
    "sys/kern/kern_time.c:1047"
  ],
  "poc_changes": "fattime_poc.c written fresh for this pack (utimes+stat readback); findentry.c helper added to prove on-disk directory-entry bytes; fattime_host.c harness carries verbatim function bodies for full-range math",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1470,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O2 -o /root/fattime_poc fattime_poc.c && cc -Wall -O2 -o /root/findentry findentry.c",
  "run_cmd": "./run.sh  (vnconfig+newfs_msdos+mount_msdos /dev/vn0 /mnt; fattime_poc /mnt/W1 4295030400; fattime_poc /mnt/W2 4354750800)",
  "code_hash": "13797d5aeda90b99be539adb7f9d664073a268339bf5306529248e9521c36bdf",
  "notes": "Distinct from known DF-0199 (day-0 underflow): here the on-disk date is valid and correctly encoded; only the decoder multiply wraps. Also triggers read-only from crafted media (DF-2902 attach threat model) containing year>=126 dates. Guest reset (with-src) after validation.",
  "recommended_fix": "Widen the product: tsp->tv_sec += (time_t)DAY * day; in fattime2timespec",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Fri Sep  4 04:56:16 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Rebuilt X86_64_GENERIC with fix.diff ((time_t)DAY cast; build+install RC=0). Baseline kernel #0: W1->1970-01-01, W2->1971-11-23. Patched kernel #1: W1 and W2 MATCH exactly (4295030400 / 4354750800); control date unchanged. Bad behavior gone.",
  "fix_evidence": "poc_fixed.log (W1/W2 MATCH, rc=0); fix.diff in pack; build.log excerpt in notes of run"
}