DF-0853 — PoC evidence pack

Bug

sys/vfs/isofs/cd9660/cd9660_vfsops.c iso_mountfs(): the high_sierra flag is set to 1 whenever any volume descriptor matches the Sierra id ("CDROM") at :340 but is never reset when a later descriptor matches the Standard ISO9660 id ("CD001"). The flag is then consulted at :342 (to pick vdp->type vs vdp->type_sierra) and at :396-417 (to pick pri vs pri_sierra field offsets). Since pri and pri_sierra are both casts of the same buffer (:347-349), reading the wrong one parses a Standard ISO9660 PVD at Sierra offsets — classic type confusion. The kernel then logs cd9660: High Sierra Format (:503) and sets iso_ftype = ISO_FTYPE_HIGH_SIERRA for an image whose actual primary descriptor is Standard ISO9660.

Reachability / threat model

• mount -t cd9660 requires either VREAD on the device node or SYSCAP_RESTRICTEDROOT (cd9660_vfsops.c:235-243). With vfs.usermount=1 and a root-created, attacker-owned image attached via vnconfig, an unprivileged user can reach this path — i.e. the realistic "admin handed the user a mountable ISO" precondition. The bug is independent of privilege: the type confusion fires whenever the crafted image is parsed.
• No memory-corruption primitive is acquired: all bread()s are device-bounded and the bcopy(rootp, isomp->root, 34) stays inside the 2048-byte descriptor buffer. The damage is misinterpretation of metadata (wrong logical_block_size, volume_space_size, root_extent, root_size, and iso_ftype), which then drives different downstream parsing routines in cd9660_vnops.c.

PoC

make_crafted_iso.c emits a 100-sector image: - sector 16 — Sierra decoy: id_sierra="CDROM" → sets high_sierra=1; type_sierra=3 → switch default-case, not primary, not end. - sector 17 — Standard ISO9660 PVD: id="CD001" → standard match, does not touch high_sierra; system_id[0]=1 so the sticky vdp->type_sierra read returns ISO_VD_PRIMARY. Bytes 136-137 are forced to 0x00 0x08 so the Sierra-cast logical_block_size decodes to 2048, passing the DEV_BSIZE..MAXBSIZE power-of-2 validation at :401 and letting the mount succeed. - sector 18 — Standard VD_END: system_id[0]=255 so type_sierra read returns ISO_VD_END, exits the loop.

Build

cc -O2 -o make_crafted_iso make_crafted_iso.c

Run (as root; or as maxx with vfs.usermount=1 + chowned device)

./make_crafted_iso crafted.iso
vnconfig -c vn0 ./crafted.iso
mkdir -p /mnt/df0853
mount -t cd9660 -o ro /dev/vn0 /mnt/df0853     # rc=0, mount succeeds
dmesg | tail                                   # prints "cd9660: High Sierra Format"
umount /mnt/df0853
vnconfig -u vn0

Expected (bug present, unpatched #0)

cd9660: High Sierra Format

The kernel misclassifies a Standard ISO9660 image as High Sierra — observable proof of the type confusion. iso_ftype = ISO_FTYPE_HIGH_SIERRA is set despite the actual PVD being Standard.

Expected (FIXED, #1)

Mount still succeeds (the PVD is a valid Standard ISO9660 image) but no cd9660: High Sierra Format message is printed: high_sierra is correctly reset to 0 when the Standard descriptor is recognised.

Reproduce helpers

• build.sh — compile the ISO generator.
• run.sh — generate ISO, attach via vnconfig, mount, dump dmesg tail, unmount. Prints HIGH_SIERRA_COUNT=N so you can compare unpatched (>=1) vs patched (0).

Impact assessment

• Class: type confusion / incorrect type conversion (CWE-704) — not memory corruption. No OOB, no UAF, no write primitive.
• Ceiling: kernel misinterprets attacker-chosen ISO metadata fields (logical_block_size, volume_space_size, root_extent, root_size) at the wrong struct offsets, and selects ISO_FTYPE_HIGH_SIERRA parsing paths for a Standard ISO9660 image. In our test this manifested as ls returning ENOTDIR because root_extent was misread; no panic in 3+ runs.
• Severity: Low (matches finding classification). Reachable from an unprivileged user only under the vfs.usermount=1 + chowned-image precondition, and yields no privilege or memory-corruption primitive — only metadata-driven misbehaviour on the attacker's own mount.

DF-0853 — VERDICT

Verdict: REPRODUCED (and FIX VALIDATED on a built & booted single-fix kernel).

Mechanism (trigger → primitive → effect)

iso_mountfs() in sys/vfs/isofs/cd9660/cd9660_vfsops.c walks the volume descriptor sequence (sectors 16..100, :326-384). For each descriptor:

/* :334-341 */
if (bcmp (vdp->id, ISO_STANDARD_ID, sizeof vdp->id) != 0) {
    if (bcmp (vdp->id_sierra, ISO_SIERRA_ID,
              sizeof vdp->id) != 0) {
        error = EINVAL;
        goto out;
    } else
        high_sierra = 1;          /* <-- set but NEVER reset */
}
switch (isonum_711 (high_sierra? vdp->type_sierra: vdp->type)){
case ISO_VD_PRIMARY:
    if (pribp == NULL) {
        pribp = bp; bp = NULL;
        pri       = (struct iso_primary_descriptor *)vdp;
        pri_sierra= (struct iso_sierra_primary_descriptor *)vdp;  /* SAME buffer */
    }
    break;

high_sierra is initialised to 0 at :278 and only ever set to 1 at :340. If a Sierra-format descriptor appears anywhere in the sequence, every subsequent Standard ISO9660 descriptor is misread:

• The type selector at :342 reads vdp->type_sierra (byte offset 8) of the Standard descriptor — which is actually system_id[0], an attacker-controlled byte.
• Once such a misread selects ISO_VD_PRIMARY, pri and pri_sierra both point at the same Standard PVD buffer (:347-349).
• The field reads at :396-417 use pri_sierra->FIELD:
• logical_block_size reads standard PVD bytes 136-137 (inside the standard path_table_size field, BE half).
• volume_space_size reads standard PVD bytes 88-91 (inside the standard unused3 region — fully attacker-controlled).
• root_directory_record reads standard PVD bytes 180-213 (overlaps the tail of standard root_directory_record + start of volume_set_id — attacker-controlled root_extent, root_size).
• iso_ftype is then set to ISO_FTYPE_HIGH_SIERRA at :504, and the kernel logs cd9660: High Sierra Format at :503 — the observable marker that proves the misclassification.

Reproduction (unpatched 6.5-DEVELOPMENT #0)

make_crafted_iso.c emits a 100-sector image:

Mount result on the unpatched kernel (3 consecutive runs all identical):

vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
cd9660: High Sierra Format            <-- TYPE CONFUSION PROOF
MOUNT_RC=0

The mount succeeds, but downstream metadata is misinterpreted: an ls of the mount point returns ENOTDIR because root_extent was read at the wrong offset. No panic in 3+ runs — the bug is type confusion, not memory corruption. All bread()s stay device-bounded and the 34-byte bcopy of rootp stays inside the 2048-byte descriptor buffer.

Impact

• Class: CWE-704 Incorrect Type Conversion. Not memory corruption.
• Reachability: mount -t cd9660 requires VREAD on the device OR SYSCAP_RESTRICTEDROOT (:235-243). With vfs.usermount=1 and a root-created, attacker-owned image attached via vnconfig, an unprivileged user reaches this path — the realistic "admin handed the user a mountable ISO" precondition. The bug itself is privilege-independent.
• Ceiling: attacker-chosen ISO controls logical_block_size, volume_space_size, root_extent, root_size, and iso_ftype for the mounted filesystem, all read at the wrong struct offsets. No OOB read/write, no UAF, no privilege boundary crossed. Severity Low matches the finding.

Fix

The minimal, root-cause fix is to reset high_sierra = 0 whenever the current descriptor matches the Standard ISO9660 id:

--- a/sys/vfs/isofs/cd9660/cd9660_vfsops.c
+++ b/sys/vfs/isofs/cd9660/cd9660_vfsops.c
@@ -338,7 +338,8 @@
                goto out;
            } else
                high_sierra = 1;
-       }
+       } else
+           high_sierra = 0;
        switch (isonum_711 (high_sierra? vdp->type_sierra: vdp->type)){

Fix validation (built + booted single-fix kernel)

Before/after contrast — decisive:

Baseline #0:

vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
cd9660: High Sierra Format
=== baseline-high-sierra-count: 1 ===

Patched #1:

run1 MOUNT_RC=0
run2 MOUNT_RC=0
=== total-high-sierra-prints: 0 ===

The fix closes the bug: the same crafted ISO that triggered the misclassification on #0 produces zero High Sierra Format prints on #1, and the mount still succeeds because the Standard PVD is a valid ISO9660 image once parsed at the correct offsets.

Files

• make_crafted_iso.c — ISO generator (the trigger).
• build.sh, run.sh — reproduce panel scripts.
• build.log, run.log, fix_build.log — full untrimmed logs.
• panic.txt — N/A (no panic observed; type confusion only).
• env.txt — guest environment.
• fix.diff — git-apply-able single-hunk fix.
• manifest.json — catalog.