DF-0790 — ATTRLIST parsing DoS in ntfs_ntvattrget

Verdict: REPRODUCED (live kernel hang + deterministic harness) → FIX VALIDATED Impact: dos (kernel hang / local DoS via crafted NTFS image; no escalation) Confidence: certain

What this is

ntfs_ntvattrget (sys/vfs/ntfs/ntfs_subr.c:196-236) walks the on-disk $ATTRIBUTE_LIST to find an attribute referenced from another MFT record. The walk advances by aalp->reclen without checking reclen == 0 (→ infinite loop / kernel hang) or reclen > len (→ size_t underflow → NULL deref panic). A crafted NTFS image triggers it at mount time.

How to reproduce

1. Userspace harness (deterministic, unprivileged)

ssh -F dfbsd-qemu/config dfbsd-maxx 'mkdir -p poc/DF-0790'
scp -F dfbsd-qemu/config -q {harness.c,build.sh,run.sh} dfbsd-maxx:poc/DF-0790/
ssh -F dfbsd-qemu/config dfbsd-maxx 'cd poc/DF-0790 && sh build.sh && sh run.sh'

Expected: loop → rc=1 (iteration cap = infinite loop in kernel); null → rc=2 (SIGSEGV = NULL deref).

2. Live kernel trigger (root — EXPECTS HANG, guest dies)

python3 gen_ntfs_0790.py mount_loop ntfs_0790_mount_loop.img
scp -F dfbsd-qemu/config -q ntfs_0790_mount_loop.img dfbsd:/root/
./dfbsd-qemu/vm.sh run_root 'vnconfig -c vn0 /root/ntfs_0790_mount_loop.img && mount_ntfs -o ro /dev/vn0 /mnt/ntfs'
# ^mount(2) NEVER RETURNS — guest wedged (infinite loop in ntfs_ntvattrget)
./dfbsd-qemu/vm.sh reset with-src

3. Fix validation (rebuild ntfs.ko module — no kernel reboot needed)

scp -F dfbsd-qemu/config -q fix.diff dfbsd:/root/
./dfbsd-qemu/vm.sh run_root 'cd /usr/src && patch -p1 < /root/fix.diff && cd sys/vfs/ntfs && KERNCONF=X86_64_GENERIC make && cp ntfs.ko /boot/kernel/ntfs.ko'
# re-run step 2; mount now fails cleanly: "Invalid argument" (EINVAL), guest stays UP
# dmesg: ntfs_ntvattrget: malformed attrlist entry (reclen 0, len 26)

Files

• harness.c — deterministic userspace replication of the ATTRLIST walk (guard-page backed).
• gen_ntfs_0790.py — crafted NTFS image generator (ino-5 and mount-time ino-6 variants).
• fix.diff — the validated fix (rejects reclen==0 / reclen>len with EINVAL).
• VERDICT.md — full narrative with path:line citations.
• hang_evidence.txt / fix_run.log — live before/after evidence.

DF-0790 — ATTRLIST parsing DoS in ntfs_ntvattrget: reclen==0 infinite loop / reclen>len NULL deref

Verdict: REPRODUCED (live kernel hang on default GENERIC #0 + deterministic userspace harness) → FIX VALIDATED

The bug (confirmed by source trace + live hang + harness)

File: sys/vfs/ntfs/ntfs_subr.c:196-236 (function ntfs_ntvattrget) Class: CWE-835 (infinite loop) + CWE-476 (NULL deref) — both stem from the same missing bounds check on aalp->reclen. Severity (per finding): Medium. Confirmed: realistic impact ceiling is kernel hang / local DoS (no write primitive, no escalation).

186:    len = lvap->va_datalen;
187:    alpool = kmalloc(len, M_TEMP, M_WAITOK);
188:    error = ntfs_readntvattr_plain(ntmp, ip, lvap, 0, len, alpool, &len, NULL);
...
193:    aalp = (struct attr_attrlist *) alpool;
194:    nextaalp = NULL;
196:    for(; len > 0; aalp = nextaalp) {
202:        if (len > aalp->reclen) {
203:            nextaalp = NTFS_NEXTREC(aalp, struct attr_attrlist *);   // = aalp + aalp->reclen
204:        } else {
205:            nextaalp = NULL;
206:        }
207:        len -= aalp->reclen;        // <-- NO CHECK that reclen != 0, no check reclen <= len
...
236:    }

struct attr_attrlist (ntfs.h:144-154): al_type(u32) reclen(u16) al_namelen(u8) al_nameoff(u8) al_vcnstart(u64) al_inumber(u32) reserved(u32) al_index(u16) al_name[1](u16).

NTFS_NEXTREC (ntfs.h:273): #define NTFS_NEXTREC(s, type) ((type)(((caddr_t) s) + (s)->reclen)).

Two malformed-image shapes, both unguarded:

Reachability (mount-time — before the sibling lockmgr panic)

ntfs_ntvattrget's ATTRLIST walk is entered when a requested attribute is NOT found inline in the MFT record but a $ATTRIBUTE_LIST (type 0x20) IS present (ntfs_findvattr returns -1 with lvap = the ATTRLIST ntvattr, ntfs_subr.c:133). The walk then reads the ATTRLIST data into a heap buffer (alpool) and walks it looking for the attribute in other MFT records.

The mount-time trigger fires during ntfs_mountfs:

sys/vfs/ntfs/ntfs_vfsops.c:394-396   ntfs_mountfs() loops over {NTFS_MFTINO, NTFS_ROOTINO, NTFS_BITMAPINO}
sys/vfs/ntfs/ntfs_vfsops.c:396          VFS_VGET(mp, NULL, NTFS_BITMAPINO, ...)
sys/vfs/ntfs/ntfs_vfsops.c:796          .vfs_vget = ntfs_vget -> ntfs_vgetex(NTFS_A_DATA)
sys/vfs/ntfs/ntfs_vfsops.c:745-746      ntfs_vgetex -> ntfs_filesize (for regular-file inos)
sys/vfs/ntfs/ntfs_subr.c:1295           ntfs_filesize -> ntfs_ntvattrget(NTFS_A_DATA)
sys/vfs/ntfs/ntfs_subr.c:175            ntfs_findvattr -> returns -1 (no inline $DATA; lvap=ATTRLIST)
sys/vfs/ntfs/ntfs_subr.c:196-236        BUGGY ATTRLIST walk

The crafted image places a corrupted $ATTRIBUTE_LIST on ino 6 ($Bitmap) with no inline $DATA. During mount, ntfs_filesize(ino 6) calls ntfs_ntvattrget(NTFS_A_DATA), which finds no inline $DATA, enters the ATTRLIST walk, and hits the reclen==0 infinite loop. This fires during mount, before any directory lookup, so the sibling DF-0786 lockmgr panic (which lives in ntfs_ntget on the directory-lookup path) cannot interfere.

The threat model is the standard filesystem-image model: vfs.usermount=0 (verified) means the attacker needs root to issue mount_ntfs (e.g. an admin auto-mounting an untrusted USB stick / image, or a crafted image placed where root will mount it). The post-mount attribute request that reaches ntfs_ntvattrget is unprivileged (any local user with execute on the mountpoint).

Reproduction — live kernel (default GENERIC #0)

Trigger (as root):

vnconfig -c vn0 /root/ntfs_0790_mount_loop.img
mount_ntfs -o ro /dev/vn0 /mnt/ntfs

Result: kernel HANG. mount(2) never returns; the ssh command timed out after 30s (rc=124); the guest became completely unresponsive (subsequent ssh status check also timed out, rc=124) — the kernel is spinning at 100% CPU in the ntfs_ntvattrget ATTRLIST walk. No panic signature (this is CWE-835 infinite loop, not a crash); the serial log shows a clean boot followed by the mount command hanging forever. Confirmed local DoS.

Reproduction — userspace harness (deterministic complement)

harness.c replicates the exact ATTRLIST walk (ntfs_subr.c:196-236) against a buffer placed at the end of a writable page with a PROT_NONE guard page after it. Output (run as unprivileged maxx):

=== BUGGY walk (kernel behaviour on default GENERIC #0) ===
mode=clean       apply_fix=0    -> rc=0  clean exit (ATTRLIST exhausted)
mode=loop        apply_fix=0    -> rc=1  ITERATION CAP HIT -> would be infinite loop in kernel
mode=null        apply_fix=0    -> rc=2  SIGSEGV -> NULL deref / OOB read in kernel
mode=oob_reclen  apply_fix=0    -> rc=2  SIGSEGV -> NULL deref / OOB read in kernel

=== FIXED walk (proposed fix rejects malformed entries) ===
mode=clean       apply_fix=1    -> rc=0  clean exit (ATTRLIST exhausted)
mode=loop        apply_fix=1    -> rc=-1  FIX REJECTED malformed entry (EINVAL in kernel)
mode=null        apply_fix=1    -> rc=-1  FIX REJECTED malformed entry (EINVAL in kernel)
mode=oob_reclen  apply_fix=1    -> rc=-1  FIX REJECTED malformed entry (EINVAL in kernel)

• loop confirms the infinite-loop branch (reclen==0, caught by iteration cap that the kernel does NOT have).
• null confirms the NULL-deref branch (reclen>len → size_t underflow → nextaalp==NULL → SIGSEGV).
• oob_reclen confirms a bonus OOB-read branch (reclen pushes next ptr past buffer end → guard-page fault).

Escalation assessment (no chain possible — loop/NULL-deref only)

This is a control-flow primitive (infinite loop) or a NULL deref (panic). There is no write to attacker-chosen kernel memory: the only effect is hanging the calling thread or crashing the kernel. Per Phase 6, a pure DoS/panic primitive has no escalation chain to uid=0; the correct deliverable is the characterized impact ceiling: definite local DoS (kernel hang requiring a reset, or NULL-deref panic).

Fix — fix.diff

Adds a bounds check at the top of the loop body, BEFORE any field dereference or walk advancement:

• Require the fixed entry header to fit in the remaining len (len >= sizeof(struct attr_attrlist) - sizeof(u_int16_t), i.e. 26 bytes — the documented minimum ATTRLIST entry size, excluding the flexible al_name[] tail).
• Require aalp->reclen to be sane: at least the header size, and not greater than len.
• On violation: set error = EINVAL, kprintf for diagnostics, goto out (clean return; alpool freed).

This rejects both malformed shapes: - reclen == 0 → caught by aalp->reclen < min_header → EINVAL (no infinite loop). - reclen > len → caught by aalp->reclen > len → EINVAL (no size_t underflow, no NULL deref).

The fix is minimal and targeted at the root cause (the missing reclen bounds check). It does not change the on-disk format, the NTFS_AALPCMP logic, the ntfs_vgetex path, or the happy path for valid images.

Fix validation (Phase 8) — VALIDATED

ntfs.ko was rebuilt standalone (KERNCONF=X86_64_GENERIC make in sys/vfs/ntfs/, warm obj) and installed to /boot/kernel/ntfs.ko. NTFS is optional ntfs (a loadable module, not compiled into GENERIC), so only the module needed rebuilding — no kernel rebuild or reboot required.

Before (unpatched ntfs.ko, kernel #0)

mount_ntfs -o ro /dev/vn0 /mnt/ntfs   # ntfs_0790_mount_loop.img
-> mount(2) NEVER RETURNS. ssh timed out after 30s (rc=124).
   Guest completely wedged; kernel spinning in ntfs_ntvattrget.

After (patched ntfs.ko, same kernel #0)

mount_ntfs -o ro /dev/vn0 /mnt/ntfs   # ntfs_0790_mount_loop.img
mount_ntfs: /dev/vn0: Invalid argument   MOUNT_RC=71   (<1s, guest UP)
dmesg: ntfs_ntvattrget: malformed attrlist entry (reclen 0, len 26)

mount_ntfs -o ro /dev/vn2 /mnt/ntfs2  # ntfs_0790_mount_null.img
mount_ntfs: /dev/vn2: Invalid argument   MOUNT_RC=71   (<1s, guest UP)
dmesg: ntfs_ntvattrget: malformed attrlist entry (reclen 32, len 26)

Regression check (clean NTFS image still mounts)

mount_ntfs -o ro /dev/vn1 /mnt/ntfs   # clean DF-0786 ntfs.img
-> MOUNT_RC=0   /dev/vn1 on /mnt/ntfs (ntfs, read-only, local)

The fix closes the bug on the default GENERIC kernel without regressing valid images.

PoC changes

• harness.c — userspace replication of ntfs_ntvattrget:196-236 against a guard-page-backed ATTRLIST buffer. Accepts clean|loop|null|oob_reclen mode and an optional apply_fix flag that runs the proposed fixed walker for direct before/after comparison.
• gen_ntfs_0790.py — crafted-image generator building on the proven DF-0786 NTFS scaffolding. Two trigger variants:
• ino-5 (root dir) variant: loop/null modes corrupt the root dir's $ATTRIBUTE_LIST.
• mount-time variant: mount_loop/mount_null place the corrupted $ATTRIBUTE_LIST on ino 6 ($Bitmap) with no inline $DATA, so the bug fires DURING mount via ntfs_filesize — before the sibling DF-0786 lockmgr panic can interfere.
• build.sh / run.sh — exact reproducible build & run. run.sh runs the harness (as maxx); the live mount trigger requires root and is documented in hang_evidence.txt.
• fix.diff — standalone, git apply-able unified diff fixing the bug at the root cause.

How to reproduce (for a teammate)

# 1. userspace harness (deterministic, no root)
scp -F dfbsd-qemu/config -q findings/poc/DF-0790/{harness.c,build.sh,run.sh} dfbsd-maxx:poc/DF-0790/
ssh -F dfbsd-qemu/config dfbsd-maxx 'cd poc/DF-0790 && sh build.sh && sh run.sh'

# 2. live kernel reproduction (root, EXPECTS HANG — guest dies, must reset after)
python3 findings/poc/DF-0790/gen_ntfs_0790.py mount_loop /tmp/ntfs_0790_mount_loop.img
scp -F dfbsd-qemu/config -q /tmp/ntfs_0790_mount_loop.img dfbsd:/root/
./dfbsd-qemu/vm.sh run_root 'vnconfig -c vn0 /root/ntfs_0790_mount_loop.img && mount_ntfs -o ro /dev/vn0 /mnt/ntfs'
# ^HANGS FOREVER — guest wedged
./dfbsd-qemu/vm.sh reset with-src

# 3. fix validation (rebuild ntfs.ko, install, re-run same PoC)
scp -F dfbsd-qemu/config -q findings/poc/DF-0790/fix.diff dfbsd:/root/
./dfbsd-qemu/vm.sh run_root 'cd /usr/src && patch -p1 < /root/fix.diff && cd sys/vfs/ntfs && KERNCONF=X86_64_GENERIC make && cp ntfs.ko /boot/kernel/ntfs.ko'
# re-run step 2; mount now fails cleanly with EINVAL, guest stays UP