⬢ DragonFlyBSD Kernel Audit
DF-3128 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3128",
  "verdict": "reproduced",
  "impact": "dos",
  "reproduced": 1,
  "confidence": "certain",
  "summary": "mountmsdosfs() never bounds BPB geometry by the backing device size (dropped FreeBSD mediasize check); crafted 9 GiB image claiming a 1.5 TiB FAT32 volume mounts in 38 s of non-interruptible kernel work, wires an attacker-chosen 128 MiB pm_inusemap per mount (max 512 MiB), stacks linearly with concurrent mounts, and reports 512 GiB in statfs",
  "kernel_refs": [
    "sys/vfs/msdosfs/msdosfs_vfsops.c:432",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:434",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:439",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:463",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:484",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:565",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:578",
    "sys/vfs/msdosfs/msdosfs_fat.c:884"
  ],
  "reproduce": {
    "build": "cd /root/df3128 && sh build.sh",
    "run": "cd /root/df3128 && sh run.sh",
    "expected": "mount rc=0 in ~38 s; df shows 536870912 1K-blocks; vmstat -m shows MSDOSFS_FAT 128M per mount (256M with two); SIGKILL mid-mount does not prevent the mount; on FreeBSD (or patched DF) mount fails EINVAL instantly"
  },
  "artifacts": [
    "README.md", "VERDICT.md", "craftfat32.c", "craftvar.c", "build.sh",
    "run.sh", "build.log", "run.log", "run.fixed2.log", "fix_build.log",
    "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ],
  "fix": {
    "status": "fixed",
    "kernel": "DragonFly dfbsd 6.5-DEVELOPMENT #2 (patched, nativekernel)",
    "baseline": "stock #0: crafted mount rc=0, 38 s, 128 MiB wired, statfs 512 GiB",
    "patched": "#2: crafted mount EINVAL in 0 s, zero allocation; legit FAT32+FAT16 mount RW OK",
    "diff": "fix.diff"
  }
}