⬢ DragonFlyBSD Kernel Audit
DF-5684 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5684",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED: sys_vquotactl(2) contains no privilege check on any command. Unprivileged uid 1001 set a mount-wide quota limit of 1 byte via base-system vquota(8) (vquota limit / 1, rc=0); afterwards EVERY regular-file write on the mount fails EDQUOT \u2014 demonstrated against root (append blocked, lifted only by the attacker). Per-uid targeting of root (vquota ulim / root 1 as uid 1001 -> ROOT_APPEND_BLOCKED), accounting wipe (sync) and all-uid usage readout (show) also unprivileged. Enforcement is universal (vfs_init.c:431 installs accounting on every FS; vfs_vopops.c:489 returns EDQUOT with no root bypass) but the whole feature is behind the default-off vfs.quota_enabled boot tunable. fix.diff (caps_priv_check_td(curthread, SYSCAP_NOQUOTA_WR)) validated on a rebuilt kernel: unpriv attempt -> EPERM, root writes unaffected, privileged set/lift regression-tested OK.",
  "exploit_chain": "unpriv vquota limit / 1 -> vq_write_ok() fails for all writers on / (incl. root) -> persistent filesystem-wide write DoS until attacker lifts or reboot; breaks passwd, logging, package ops for every user.",
  "evidence": "run.log (ROOT_WRITE_OK_BEFORE -> maxx sets limit -> ROOT_WRITE_BLOCKED_RC=2 -> ulim root -> ROOT_APPEND_BLOCKED -> restore -> OK_AFTER_RESTORE), run.patched.log (maxx EPERM, ROOT_WRITE_OK_ON_PATCHED, root set/lift regression)",
  "kernel_refs": [
    "sys/kern/vfs_quota.c:328",
    "sys/kern/vfs_quota.c:273",
    "sys/kern/vfs_quota.c:287",
    "sys/kern/vfs_quota.c:308",
    "sys/kern/vfs_quota.c:219",
    "sys/kern/vfs_vopops.c:489",
    "sys/kern/vfs_init.c:431"
  ],
  "poc_changes": "Guest vquota CLI differs from the checkout (limit/ulim/glim/show/sync, user by NAME not uid); adjusted vq_priv.sh accordingly. vquota exits 1 on success-path show (tool quirk) \u2014 success judged by output/state, not exit code.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline) / #1: Sat Oct 10 00:36:54 UTC 2026 (patched)",
  "runtime_sec": 180,
  "guest_dirty": 0,
  "build_cmd": "(none: base-system /sbin/vquota is the driver)",
  "run_cmd": "as uid 1001: vquota limit / 1 ; as root: echo x >> /root/f (expect EDQUOT)",
  "code_hash": "6d812d0029122006dfa0fc2185ea314cc4aeb386100e4a123a095aefc3c4257f",
  "notes": "Guest reset (vm.sh reset with-src) performed after the run; evidence captured on baseline kernel #0 and patched kernel #1.",
  "recommended_fix": "Add caps_priv_check_td(curthread, SYSCAP_NOQUOTA_WR) after the vfs_quota_enabled gate",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched kernel #1: vquota limit / 1 as uid 1001 returns EPERM (send_command: vquotactl = -1), mount state unchanged, root write succeeds; root set/show/lift regression OK.",
  "fix_evidence": "run.patched.log",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Sat Oct 10 00:36:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
}