⬢ DragonFlyBSD Kernel Audit
DF-2956 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
  "finding_id": "DF-2956",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "timespec2fattime() silently aliases far-future timestamps onto arbitrary 1980..2107 dates via two stacked overflows: (1) the 7-bit FAT year field overflows when (l*4)<<9 exceeds 16 bits for dates past 2107-12-31, and (2) t2 = t1/DAY truncates int64->uint32 for tv_sec >= 2^32*86400. On the stock guest kernel, utimes(2108-01-01) persists MDate=0x0021 (1980-01-01) and utimes(year 4,461,763) persists MDate=0x5777 which stats as a plausible 2023-11-23 mtime with time-of-day preserved. Unprivileged (uid 1001, -u 1001 mount, file owner; itimespecfix imposes no upper bound on tv_sec). Writes are confined to the caller's uint16_t (defined unsigned wrap; table walks stay in bounds m<=47), so impact is silent timestamp fabrication (integrity), not memory corruption. Saturating clamp T2107 validated on a rebuilt kernel: all post-2107 inputs clamp to 2107-12-31 preserving time-of-day; aliases gone.",
  "exploit_chain": "",
  "evidence": [
    "run.log X-cases: 4354819200 (2108-01-01) -> stat 315532800 (1980-01-01); 68718441600 (4147) -> 2099-07-24; 140737488355327 -> 1700716926 (2023-11-23 05:22:06)",
    "findentry.log: X1 on-disk MDate bytes 21 00 (0x0021=1980-01-01); X3 bytes 77 57 (0x5777=2023-11-23) matching harness dd predictions bit-for-bit",
    "harness_guest.log section B: dd values 0021/eef8/705c/5777/f450 for post-2107 inputs",
    "poc_unpriv.log: uid=1001 user reproduces X3 -> 2023-11-23 on -u 1001 mount",
    "poc_fixed.log: X1->2107-12-31 00:00 (disk 0xff9f), X2->2107-12-31 08:00, X3->2107-12-31 05:22:06"
  ],
  "kernel_refs": [
    "sys/kern/subr_fattime.c:157",
    "sys/kern/subr_fattime.c:173",
    "sys/kern/subr_fattime.c:139",
    "sys/vfs/msdosfs/msdosfs_vnops.c:419",
    "sys/kern/kern_time.c:1047",
    "sys/kern/vfs_syscalls.c:3847"
  ],
  "poc_changes": "fattime_poc.c written fresh (explicit utimes + stat readback is the whole trigger); findentry.c added for on-disk proof; fattime_host.c section B enumerates the alias map",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1470,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O2 -o /root/fattime_poc fattime_poc.c && cc -Wall -O2 -o /root/findentry findentry.c",
  "run_cmd": "./run.sh (vnconfig+newfs_msdos+mount_msdos; fattime_poc /mnt/X1 4354819200; fattime_poc /mnt/X3 140737488355327)",
  "code_hash": "13797d5aeda90b99be539adb7f9d664073a268339bf5306529248e9521c36bdf",
  "notes": "Distinct from known DF-0200 (negative tv_sec path). The year-4.4M -> 2023-11-23 alias is the worst case: fabricated plausible recent mtime. Guest reset (with-src) after validation.",
  "recommended_fix": "Saturate: after t2 -= T1980 clamp t2 to T2107 ((2108-1980)*YEAR+31-1) in timespec2fattime",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Fri Sep  4 04:56:16 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Rebuilt X86_64_GENERIC with fix.diff (T2107 saturation; build+install RC=0). Baseline: X1->1980-01-01 (disk 0x0021), X3->2023-11-23 (disk 0x5777). Patched: X1->2107-12-31 00:00 with disk MDate=0xff9f (maximal representable date), X2->2107-12-31 08:00, X3->2107-12-31 05:22:06. All silent aliases eliminated; no regressions in control or W cases.",
  "fix_evidence": "poc_fixed.log (X-case outputs + findentry X1 on-disk 9f ff after fix)"
}