DF-0852 — Unvalidated user ssector → signed-integer overflow in cd9660

File: sys/vfs/isofs/cd9660/cd9660_vfsops.c Severity: Low (auditor) — confirmed: real signed-integer overflow, but root-only reachability and no write/corruption primitive (int size field), so impact ceiling = DoS/info-confusion (poisoned statfs).

Claim

iso_args.ssector (a signed int, copied in from userspace in cd9660_mount at cd9660_vfsops.c:197) is never range-checked. It then drives: - the volume-descriptor scan loop for (iso_blknum = 16 + ssector; iso_blknum < 100 + ssector; ...) (:326-327) — 16+ssector / 100+ssector wrap when ssector is near INT_MAX; - the multi-session adjustment isomp->volume_space_size += argp->ssector; (:427) — overflows when volume_space_size (read from the attacker-controlled ISO Primary Volume Descriptor) plus ssector exceeds INT_MAX.

The poisoned volume_space_size is published via cd9660_statfs (:633 sbp->f_blocks = isomp->volume_space_size;) and used as a bound in cd9660_vget_internal (:775).

Reproduction

A crafted ISO 9660 image (craft_iso.py) places a valid Primary Volume Descriptor at sector 16 + SSECTOR with volume_space_size = 0x7FFFFFF0. Mounting it with ssector = 16 makes line 427 compute 0x7FFFFFF0 + 16 = 0x80000000 → INT_MIN, and statfs reports the wrapped value.

$ ./poc /dev/vn0 /tmp/df0852_mnt 16
[poc] mount() rc=0 errno=2 (No such file or directory)
[poc] statfs f_blocks = -2147483648  (0xffffffff80000000)  f_bsize=2048
[poc] !!! BOGUS f_blocks: signed-integer overflow confirmed !!!

Reachability / threat model (why Low, not higher)

get_fscap("cd9660") returns SYSCAP_RESTRICTEDROOT (sys/kern/vfs_syscalls.c get_fscap): cd9660 is not in the user-mountable set (only null/devfs/procfs/tmpfs/fuse are). The mount(2) syscall gates non-root callers with caps_priv_check_td(td, priv | __SYSCAP_NOROOTTEST) even when vfs.usermount=1. Verified empirically: an unprivileged user (maxx, uid 1001) gets EPERM even with vfs.usermount=1 + a group-readable vn device + a self-owned mountpoint. Only root (or a RESTRICTEDROOT-capable process) can reach the ssector input. Root→kernel is game-over by definition; there is no privilege boundary to cross and no escalation chain.

The primitive is an int size/bound field, not a pointer/refcount/function-pointer — there is no write that yields code execution. The realistic impact is a poisoned statfs (DoS/info-confusion for df/quota/NFS-export stats). No uid=0 chain exists (valid hard blocker: root-only reachability + non-write primitive).

Build / run

./build.sh                 # cc -o poc poc.c
python3 craft_iso.py 16 0x7FFFFFF0 iso_overflow.iso   # host: build the crafted ISO
python3 craft_iso.py 0  100          iso_normal.iso    # host: build a normal baseline ISO
# on guest (root):
vnconfig -c -s labels vn0 /root/iso_overflow.iso
./run.sh 16                 # overflow case  -> bogus f_blocks
./run.sh 2147483647         # loop-overflow  -> ssector=INT_MAX wraps loop bounds

Fix

fix.diff (git-apply-able) adds two guards in iso_mountfs(): 1. validate ssector before the loop (ssector < 0 || ssector > INT_MAX - 100 → EINVAL), closing the loop-bound overflow; 2. guard the multi-session sum (volume_space_size < 0 || volume_space_size > INT_MAX - ssector → EINVAL), closing the line-427 overflow for crafted images.

It supersedes the finding markdown's proposal (which only bounded ssector) by also guarding the image-controlled volume_space_size addition. Validated on a built-and-booted single-fix kernel (#1): the overflow is rejected with EINVAL, normal mounts still report correct f_blocks.

DF-0852 — VERDICT

Verdict: REPRODUCED (signed-integer overflow confirmed, observable) — impact DoS/info-confusion, root-only reachability, no escalation. Fix VALIDATED on a built single-fix kernel.

Root cause

iso_args.ssector is a signed int copied in from userspace by cd9660_mount (sys/vfs/isofs/cd9660/cd9660_vfsops.c:197, copyin(data, &args, sizeof(struct iso_args))) with no validation anywhere (confirmed by grep: the only other ssector use is the kernel's own iso_get_ssector root-mount probe at :162, not user input). It flows directly into three signed-arithmetic sites in iso_mountfs():

• :326 for (iso_blknum = 16 + argp->ssector; — wraps when ssector > INT_MAX - 16
• :327 iso_blknum < 100 + argp->ssector; — wraps when ssector > INT_MAX - 100
• :427 isomp->volume_space_size += argp->ssector; — wraps when volume_space_size + ssector > INT_MAX

The kernel is built with -fno-strict-overflow (confirmed in nk_fix.log CFLAGS), so the signed overflow wraps silently rather than trapping — no INVARIANTS/KASSERT fires (none exists in this file; verified by grep).

Mechanism (confirmed, path:line at each hop)

1. User issues mount("cd9660", mnt, &args, MNT_RDONLY) with args.ssector controlled. :197 copyin → :246 iso_mountfs(devvp, mp, &args).
2. :326-327 the volume-descriptor loop iterates iso_blknum over [16+ssector, 100+ssector). With a modest ssector and a crafted ISO whose PVD sits at sector 16+ssector, the loop finds the PVD and pri is set.
3. :414-417 isomp->volume_space_size = isonum_733(pri->volume_space_size) reads the image-controlled value (e.g. 0x7FFFFFF0).
4. :427 isomp->volume_space_size += argp->ssector overflows: 0x7FFFFFF0 + 16 = 0x80000000 = INT_MIN. The mount succeeds (:542 return 0).
5. :633 cd9660_statfs: sbp->f_blocks = isomp->volume_space_size publishes INT_MIN (sign-extended to long → -2147483648 / 0xffffffff80000000).

The PoC observes this directly via statfs(2) → f_blocks = -2147483648. Reproduced deterministically 3/3.

The loop-bound variant (ssector = INT_MAX) makes 16+ssector and 100+ssector wrap to -2147483633 / -2147483549; the kernel executes the overflowed arithmetic and then fails the mount (negative-offset bread), proving ssector is accepted unvalidated.

Why no escalation (Phase 6 hard blocker — valid)

• Root-only reachability. sys/kern/vfs_syscalls.c get_fscap() returns SYSCAP_RESTRICTEDROOT for cd9660 (only null/devfs/procfs/tmpfs/fuse are user-mountable). sys_mount gates non-root callers with caps_priv_check_td(td, priv | __SYSCAP_NOROOTTEST) even with vfs.usermount=1. Verified empirically: maxx (uid 1001) gets EPERM mounting cd9660 even with vfs.usermount=1 + a group-readable vn0 + a self-owned mountpoint. Only root (or RESTRICTEDROOT) reaches ssector. Root→kernel is game-over; there is no privilege boundary to cross.
• Non-write primitive. volume_space_size is an int size/bound field, not a pointer/refcount/function-pointer. The corruption poisons statfs and weakens/strengthens the :775 lbn >= volume_space_size check, but yields no code-exec primitive. There is no chain to uid=0.

Realistic impact ceiling = DoS/info-confusion (poisoned statfs for df/quota/NFS-export accounting), gated behind root. This matches the auditor's Low severity.

PoC changes

The finding shipped with no PoC folder (only the DB row). I created the full evidence pack from scratch: - craft_iso.py — host-side generator for a minimal valid ISO 9660 image with a controllable ssector layout and a crafted volume_space_size near INT_MAX so line 427 overflows; also generates a normal baseline image. - poc.c — drives mount(2) directly with a controllable ssector, reports errno, and on success statfs(2) f_blocks (with a bogus-value detector). - build.sh / run.sh — exact build & run. - fix.diff — the validated fix (supersedes the finding proposal).

Fix

fix.diff adds two minimal guards in iso_mountfs(): 1. after joliet_level = 0; (:325), before the loop: if (argp->ssector < 0 || argp->ssector > INT_MAX - 100) { error = EINVAL; goto out; } — closes the loop-bound overflow (:326-327); 2. before :427: if (isomp->volume_space_size < 0 || isomp->volume_space_size > INT_MAX - argp->ssector) { error = EINVAL; goto out; } — closes the image-controlled volume_space_size + ssector overflow.

Adds #include <machine/limits.h> for INT_MAX (the kernel's <sys/param.h> only includes <machine/limits.h> under #ifndef _KERNEL). This supersedes the finding's proposal (which bounded only ssector) by also guarding the image-controlled sum.

Fix validation (Phase 8)

• Baseline #0 (unpatched with-src): overflow case → mount rc=0, f_blocks = -2147483648. Reproduced.
• Single-fix kernel #1 (built make nativekernel, installed via make installkernel, booted): overflow case → mount rc=-1 errno=EINVAL (2× deterministic); loop-overflow (ssector=INT_MAX) → EINVAL; normal ISO (VSS=100, ssector=0) → mount rc=0, f_blocks=100 (no regression).
• fix_status = fixed. See fix_before_after.txt for the before/after contrast and fix_run.log for the full patched-kernel run.