⬢ DragonFlyBSD Kernel Audit
DF-3209 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-3209",
  "status": "untested",
  "reproduced": 0,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "xdr_string_encode() allocates its request mbuf without M_ZERO, copies only the strlen(path) payload bytes, but sets m_len to the 4-byte-padded XDR length and transmits it via sosend(); the 1-3 stale kernel-heap pad bytes after every non-4-aligned path string leak to the mountd/NFS server and any on-path LAN observer. Proven by inspection (krpc_subr.c:466-477, mbuf.h m_getl flags=0 path); not runtime-testable because the only callers are the #if BOOTP||NFS_ROOT boot-mount RPCs (nfs_mountrpc.c:143,160,245) and the audit guest boots from disk, so nfs_mountroot never executes \u2014 same boot-path ceiling as DF-3203/3204/3205.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3209/VERDICT.md (6-step path:line proof); decisive lines: krpc_subr.c:472 (m_getl flags=0, no M_ZERO), :474 (m->m_len=mlen includes pad), :476 (bcopy of only len bytes), mbuf.h:584-602 (m_getl->m_get does not zero); callers nfs_mountrpc.c:143,160,245",
  "kernel_refs": [
    "sys/vfs/nfs/krpc_subr.c:466",
    "sys/vfs/nfs/krpc_subr.c:472",
    "sys/vfs/nfs/krpc_subr.c:474",
    "sys/vfs/nfs/krpc_subr.c:476",
    "sys/vfs/nfs/nfs_mountrpc.c:143",
    "sys/vfs/nfs/nfs_mountrpc.c:160",
    "sys/vfs/nfs/nfs_mountrpc.c:245",
    "sys/sys/mbuf.h:584"
  ],
  "poc_changes": "none \u2014 seed sketch not executable: builder only runs on the boot path; verdict derived from source arithmetic (dlen=(len+3)&~3 vs bcopy len) plus verified m_getl non-zeroing semantics",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC; hammer2 disk root \u2014 boot path compiled in via NFS_ROOT at sys/config/X86_64_GENERIC:29 but never executed)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Boot-path-only disclosure (0-3 stale heap bytes per boot RPC, <=3 requests per boot). Enum constraint: not_testable is not a legal poc status, hence untested with the ceiling documented here and in VERDICT.md. Guest checked live: nfs_mountroot unreachable on disk-root boot; no runtime syscall path reaches the static nfs_mountdiskless->md_mount chain.",
  "recommended_fix": "bzero the XDR pad tail in xdr_string_encode (bcopy(str, xs->data, len); bzero(xs->data+len, dlen-len)) or allocate with M_ZERO"
}