⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0099

Off-by-one heap NUL-byte overflow in vfs_mountroot_try via ksscanf width/buffer-size mismatch

Summary

vfs_mountroot_try (vfs_conf.c:419-431): vfsname=kmalloc(MFSNAMELEN=16) devname=kmalloc(MNAMELEN=80); format ksprintf(patt,"%%%d[a-z0-9]:%%%ds",MFSNAMELEN,MNAMELEN) -> "%16[a-z0-9]:%80s" (:430); ksscanf(mf,patt,vfsname,devname) (:431). subr_scanf CT_CCL (:338-352) writes width chars then *p=0 NUL -> 16 chars+NUL=17 bytes into 16-byte vfsname = 1-byte heap NUL overflow; CT_STRING (:374-383) same -> 80 chars+NUL=81 into 80-byte devname. Fires BEFORE fstype validation (:435). MFSNAMELEN define mount.h:92 "incl null" confirms correct width must be -1. Boot-time only: console mountroot prompt (:558) or loader env vfs.root.mountfrom (:171). Fix: MFSNAMELEN-1/MNAMELEN-1.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0099 · 5 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff 400 B view raw
VERDICT.md verdict source-trace and fix validation 1.3 KB ↓ raw
README.md readme reproduce instructions 836 B ↓ raw
build.sh build-log build script 329 B view raw
run.sh run-log run script 392 B view raw
README.md readme reproduce instructions
↓ download raw

DF-0099 — REPRODUCED (source-only, boot-time root only)

Build

sh build.sh

(source-only confirmation; no userspace build required for the trigger itself)

Run

sh run.sh

Expected

none (boot-time) on the unfixed kernel; after applying fix.diff the cited defect is closed. This finding was verified by source-tracing sys/kern/vfs_conf.c against the master DEV tree and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).

Mechanism

vfs_mountroot_try: vfsname=kmalloc(MFSNAMELEN=16) devname=kmalloc(MNAMELEN=80); format ksprintf(patt,"%%%d[a-z0-9]:%%%ds",MFSNAMELEN,MNAMELEN) → "%16[a-z0-9]:%80s". subr_scanf CT_CCL writes width chars + NUL, so %16[...] writes 17 bytes into vfsname[16] (1-byte overflow); %80s similarly overflows devname.

VERDICT.md verdict source-trace and fix validation
↓ download raw

DF-0099 — REPRODUCED (source-only, boot-time root only)

Verdict

REPRODUCED (source-only, boot-time root only)

Mechanism

vfs_mountroot_try: vfsname=kmalloc(MFSNAMELEN=16) devname=kmalloc(MNAMELEN=80); format ksprintf(patt,"%%%d[a-z0-9]:%%%ds",MFSNAMELEN,MNAMELEN) → "%16[a-z0-9]:%80s". subr_scanf CT_CCL writes width chars + NUL, so %16[...] writes 17 bytes into vfsname[16] (1-byte overflow); %80s similarly overflows devname.

Source trace

PoC changes

Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.

Fix validation

  • fix.diff applies cleanly with git apply --check -p1 and patch -p1 --forward.
  • Combined kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously.
  • Build log: ../../combined_40_low_severity_kernel_build.log (NK_DONE rc=0).

Use MFSNAMELEN-1 and MNAMELEN-1 in the format so width+1 == buffer size. Matches finding proposal.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED via combined kernel build rc=0.

baseline: format with MFSNAMELEN/MNAMELEN / patched: -1 in format, build rc=0.
↓ fix.diffDragonFly 6.5-DEVELOPMENT combined-build rc=0

Confirmed kernel references

Detail

Exploit chain

none (boot-time, 1-byte overflow)

Evidence (decisive lines)

vfs_conf.c:430 format uses MFSNAMELEN/MNAMELEN without -1.

PoC changes

Authored fix.diff: use MFSNAMELEN-1 and MNAMELEN-1 in the format.

Verified recommended fix

Use MFSNAMELEN-1 and MNAMELEN-1 in the ksprintf format so width+1 == buffer size. Matches finding proposal.

Verdict

REPRODUCED (source-only, boot-time). vfs_conf.c:430 ksprintf(patt,"%%%d[a-z0-9]:%%%ds",MFSNAMELEN,MNAMELEN) → "%16[a-z0-9]:%80s". subr_scanf CT_CCL writes width chars + NUL, so %16[...] writes 17 bytes into vfsname[16] (1-byte overflow); %80s similarly overflows devname.