DF-0871 — PoC evidence pack

Heap overflow in NTFS $AttrDef name copy via unbounded wchar→char do/while walk. File: sys/vfs/ntfs/ntfs_vfsops.c:444,458-460. CWE-787 (OOB write). Severity: High.

The bug (confirmed line-by-line)

ntfs_mountfs() parses the on-disk $AttrDef table (MFT record 4) at mount time. For every 160-byte struct attrdef it reads, it allocates a 72-byte struct ntvattrdef and copies the attribute name with an unbounded do/while:

/* sys/vfs/ntfs/ntfs_vfsops.c */
ntmp->ntm_ad = kmalloc(num * sizeof(struct ntvattrdef), M_NTFSMNT, M_WAITOK);  /* :444 */
...
for (i=0;i<num;i++){
    ...
    j = 0;                                                       /* :457 */
    do {
        ntmp->ntm_ad[i].ad_name[j] = ad.ad_name[j];              /* :459  DEST is char[0x40]=64 */
    } while(ad.ad_name[j++]);                                     /* :460  NO bound on j */
    ntmp->ntm_ad[i].ad_namelen = j - 1;                          /* :461 */
    ntmp->ntm_ad[i].ad_type = ad.ad_type;                        /* :462 */
}

Type facts (sys/vfs/ntfs/ntfs.h): - typedef u_int16_t wchar; (ntfs.h:37) - struct attrdef { wchar ad_name[0x40]; u32 ad_type; u32 r1[2]; u32 ad_flag; u64 min; u64 max; } = 160 B (ntfs.h:206) - struct ntvattrdef { char ad_name[0x40]; int ad_namelen; u32 ad_type; } = 72 B (ntfs.h:215)

The destination ad_name is char[64] but the loop index j is bounded only by finding a NUL wchar in the source ad.ad_name[64]. If the on-disk $AttrDef record has no NUL wchar anywhere in its 64-wide-char name and its trailing 32 B (ad_type/reserved1/ad_flag/ad_minlen/ad_maxlen, which alias ad.ad_name[64..79]) are also all non-zero half-words, the walk runs j = 0..80+. The write ntmp->ntm_ad[i].ad_name[j] then:

The post-loop assignments at :461-462 "repair" the within-object bytes (ad_namelen/ad_type of entry i) but do not touch the cross-entry / past-allocation bytes written at j>=72. Those stay corrupted.

Reproduction

A) Deterministic harness (harness.c)

A faithful userspace transcription of :444,457-462 backed by a poisoned allocator (victim array at the end of a guard-paged page). No slab luck or INVARIANTS needed — the overflow is detected byte-exactly.

• buggy, num=1: do/while writes dest[j] for j>=72 → SIGSEGV at the first byte past the 72-byte ntvattrdef object. Deterministic proof the write leaves the object.
• buggy, num=2: entry[0]'s walk overwrites 72 bytes of entry[1].ad_name (cross-entry corruption, the finding's claimed primitive), then the last entry's overflow crosses the allocation → SIGSEGV.
• fixed (harness_fixed.c, mirrors fix.diff): clean exit 0, 0 bytes past the allocation, name length capped at 63 + NUL-terminated.

B) Live kernel (ntfs.ko on #0 GENERIC, INVARIANTS ON)

A crafted NTFS image (craft_img.py, 1–2 evil 160-byte $AttrDef records whose entire 160 bytes are non-zero half-words + a zero terminator) is mounted with vnconfig + mount_ntfs (root). Each mount runs the unbounded copy. During a churn loop the slab gets groomed so the corrupted ntm_ad chunk is adjacent to a victim object; the 0xFF bytes the evil data writes (truncated low-bytes of the 0xFFFFFFFF trailing fields) corrupt a victim pointer to 0xffffffffffffffff, and its later dereference faults:

Fatal trap 12: page fault while in kernel mode
fault virtual address  = 0xffffffffffffffff
instruction pointer     = 0x8:0xffffffff8063b1c6
current process         = 1015
Stopped at kqueue_register+0x526:  movq (%r15),%rdx

(panic.txt.) Controlled experiment (causation): - benign image (short NUL-terminated $AttrDef names → walk stops j<64, no overflow): 10 mount/unmount cycles, 0 panics, guest UP. - evil image: panic during churn (above).

The live panic is timing/layout-dependent (heap grooming); the harness is the deterministic proof and reproduces on every run.

Impact / threat model

• Primitive: attacker-content-controlled heap OOB write into the M_NTFSMNT slab zone (kmalloc-128/kmalloc-256). The written bytes are the low bytes of attacker-chosen on-disk wchars, so content is shapable.
• Trigger: mount -t ntfs of a crafted image. Root-only in the default config (vfs.usermount=0; mount_ntfs/vnconfig not setuid).
• Realistic threat: a malicious NTFS image (USB / download / multi-user system / automount) causes kernel heap corruption and/or panic when mounted by root — the classic untrusted-filesystem-image attack surface. High severity (kernel memory corruption from untrusted data).
• uid=0 escalation: the trigger requires root credential, so there is no unprivileged→root privilege boundary to cross end-to-end (root→kernel is game-over by definition). This is a valid hard blocker for an uid0 verdict. The primitive could be slab-groomed to escalate if an unprivileged user could mount the image (e.g. an admin sets vfs.usermount=1 and provides an attacker-owned, device-accessible image), but that is a conditional scenario, not the default.

Fix (fix.diff)

Bound the do/while to the destination array length and force NUL-termination:

-           } while(ad.ad_name[j++]);
+           } while(ad.ad_name[j++] &&
+               j < (int)sizeof(ntmp->ntm_ad[i].ad_name));
+           /* DF-0871: force NUL-termination within the fixed-size buffer
+            * so the wchar->char walk can never overrun ntvattrdef.ad_name. */
+           ntmp->ntm_ad[i].ad_name[sizeof(ntmp->ntm_ad[i].ad_name) - 1] = '\0';

This is a minimal, targeted fix at the root cause. git apply --check passes. Supersedes/matches the finding markdown's proposal.

Phase 8 — fix validation (single-fix ntfs.ko)

• Applied fix.diff to in-guest /usr/src/sys/vfs/ntfs/ntfs_vfsops.c (git apply), rebuilt ntfs.ko (cd /usr/src/sys/vfs/ntfs && make, rc=0, fix_build.log), hot-swapped (kldunload/kldload, sha256 dbc96b62…).
• Before (unpatched #0): buggy harness SIGSEGVs at j=72 (deterministic); live evil-image churn → kqueue_register panic (panic.txt).
• After (patched ntfs.ko): fixed harness exit 0, 0 bytes past the allocation (harness_compare.log); 30 evil-image mount cycles (15× num=1
• 15× num=2) → 0 panics, guest UP (fix_run.log). Benign image still mounts and parses attributes (functional regression check OK).

→ fix_status: fixed.

Files

Reproduce

On the repo root (guest up on with-src):

cd findings/poc/DF-0871
scp -F ../../../dfbsd-qemu/config craft_img.py craft_benign.py harness.c harness_fixed.c dfbsd:/root/df0871/
./../../../dfbsd-qemu/vm.sh run_root 'cd /root/df0871 && python3 craft_img.py ntfs_evil.img 2 && cc -O2 -o harness harness.c && (./harness 2; echo exit=$?)'
# deterministic: SIGSEGV at j=72 + cross-entry corruption reported

DF-0871 — VERDICT

Verdict: REPRODUCED (heap OOB write / corruption, with a live panic on GENERIC). Impact: corruption → manifests as panic (kqueue_register victim deref). Confidence: certain. Fix: VALIDATED (fixed).

Root-cause confirmation

ntfs_mountfs() (sys/vfs/ntfs/ntfs_vfsops.c) parses the on-disk $AttrDef table at mount time. For each 160-byte struct attrdef it allocates a 72-byte struct ntvattrdef and copies the attribute name with an unbounded wchar→char do/while:

• sys/vfs/ntfs/ntfs_vfsops.c:444 — ntmp->ntm_ad = kmalloc(num * sizeof(struct ntvattrdef), M_NTFSMNT, M_WAITOK); (72 B per entry)
• sys/vfs/ntfs/ntfs_vfsops.c:458-460 — c do { ntmp->ntm_ad[i].ad_name[j] = ad.ad_name[j]; /* DEST is char[0x40]=64 */ } while(ad.ad_name[j++]); /* NO bound on j */

Type facts (confirmed in sys/vfs/ntfs/ntfs.h): - ntfs.h:37 — typedef u_int16_t wchar; - ntfs.h:203 — #define NTFS_ATTRNAME_MAXLEN 0x40 (= 64) - ntfs.h:206 — struct attrdef { wchar ad_name[0x40]; u32 ad_type; u32 r1[2]; u32 ad_flag; u64 min; u64 max; } = 160 B - ntfs.h:215 — struct ntvattrdef { char ad_name[0x40]; int ad_namelen; u32 ad_type; } = 72 B

The index j is bounded only by a NUL wchar in the source ad.ad_name (which is wchar[64]). If a crafted $AttrDef record has no NUL wchar anywhere in its 64-wide-char name and its trailing 32 B (ad_type / reserved1 / ad_flag / ad_minlen / ad_maxlen, aliasing ad.ad_name[64..79]) are all non-zero half-words, the walk runs j = 0..80+. The destination write ntmp->ntm_ad[i].ad_name[j] then:

• j=0..63 → in-bounds name bytes
• j=64..67 → ntvattrdef[i].ad_namelen (repaired by :461)
• j=68..71 → ntvattrdef[i].ad_type (repaired by :462)
• j=72.. → ntvattrdef[i+1].ad_name[0..] (cross-entry) or, for the last entry, past the whole kmalloc() → HEAP OOB WRITE into M_NTFSMNT.

The post-loop assignments (:461-462) repair the within-object bytes of entry i but do not touch the bytes written at j>=72. Those stay corrupted, exactly as the finding claims.

Evidence

A. Deterministic harness (harness.c)

Faithful userspace transcription of :444,457-462 with a poisoned allocator (victim array at the end of a guard-paged page). The source is presented as an oversized wchar[256] buffer (all non-zero up to a final NUL) so the do/while is genuinely unbounded — defeating the compiler's ad_name[64] array-bounds UB assumption that would otherwise let a naïve transcription silently "pass".

• buggy, num=1: writes dest[j] for j>=72 → SIGSEGV at the first byte past the 72-byte object. Deterministic proof the write leaves the object.
• buggy, num=2: entry[0]'s walk overwrote 72 bytes of entry[1].ad_name (cross-entry corruption — the finding's claimed primitive), then the last entry's overflow crosses the 144-byte allocation → SIGSEGV.
• fixed (harness_fixed.c, mirrors fix.diff): exit 0, 0 bytes past the allocation, name length capped at 63 + NUL-terminated.

(harness_run.log, harness_compare.log.)

B. Live kernel (#0 GENERIC, INVARIANTS ON)

Crafted NTFS image (craft_img.py): 1–2 evil 160-byte $AttrDef records whose entire 160 bytes are non-zero half-words + an all-zero terminator. vnconfig + mount_ntfs (root) runs the unbounded copy on every mount. During a churn loop the slab is groomed so the corrupted ntm_ad chunk is adjacent to a victim object; the 0xFF bytes the evil data writes (truncated low-bytes of the 0xFFFFFFFF trailing fields) corrupt a victim pointer to 0xffffffffffffffff, whose later dereference faults:

Fatal trap 12: page fault while in kernel mode
fault virtual address  = 0xffffffffffffffff
Stopped at kqueue_register+0x526:  movq (%r15),%rdx

(panic.txt.)

Controlled experiment (causation): - benign image (craft_benign.py, short NUL-terminated $AttrDef names → walk stops j<64, no overflow): 10 mount/unmount cycles, 0 panics, guest UP. - evil image: kqueue_register panic during churn (above).

The live panic is timing/layout-dependent (heap-grooming); the harness is the deterministic proof and fires on every run. A single clean mount of the evil image usually produces silent within-allocation/cross-entry corruption (no immediate INVARIANTS trip because the bytes land in slab padding within the same chunk); repeated mounts groom the slab into a configuration where the corrupted chunk borders a dereferenced victim and the kernel faults.

Impact / threat model & escalation ceiling

• Primitive: attacker-content-controlled heap OOB write into the M_NTFSMNT slab zone (kmalloc-128 for num=1, kmalloc-256 for num=2). The written bytes are the low bytes of attacker-chosen on-disk wchars, so the content is shapable.
• Trigger: mount -t ntfs of a crafted image. Root-only in the default config (vfs.usermount=0; mount_ntfs/vnconfig not setuid — verified in env.txt).
• Realistic threat: a malicious NTFS image (USB / download / multi-user system / automount) causes kernel heap corruption and/or panic when mounted by root — the classic untrusted-filesystem-image attack surface. High severity (kernel memory corruption from untrusted on-disk data).
• uid=0 escalation — BLOCKED by a valid hard blocker: the write is reachable only from an already-root credential (the mount syscall requires root). Per the audit's bright-line rule, root→kernel is game-over by definition; there is no unprivileged→root privilege boundary to cross end-to-end. The primitive could be slab-groomed to escalate if an unprivileged user could mount the image (e.g. an admin sets vfs.usermount=1 and provides an attacker-owned, device-accessible image), but that is a conditional scenario, not the default config. Honest impact is therefore heap corruption / DoS (panic) from a malicious filesystem image.

PoC changes (vs. the seeded scaffolding)

This pack was built from scratch (no seeded sources). Reuses the proven DF-0785 NTFS image builder. Key additions: - craft_img.py — DF-0871 variant: evil $AttrDef (all-nonzero 160-byte records) + well-formed root dir ir_size==datalen so only the mount-time $AttrDef bug is exercised (DF-0785's lookup bug isolated). - craft_benign.py — negative-control crafter (short NUL-terminated names). - harness.c / harness_fixed.c — deterministic transcriptions. v2 of the buggy harness uses an oversized source buffer to defeat the compiler's array-bounds UB assumption (v1 silently passed at -O2).

Fix (fix.diff) — VALIDATED

Minimal, targeted fix at the root cause — bound the do/while to the destination array length and force NUL-termination:

-           } while(ad.ad_name[j++]);
+           } while(ad.ad_name[j++] &&
+               j < (int)sizeof(ntmp->ntm_ad[i].ad_name));
+           /* DF-0871: force NUL-termination within the fixed-size buffer
+            * so the wchar->char walk can never overrun ntvattrdef.ad_name. */
+           ntmp->ntm_ad[i].ad_name[sizeof(ntmp->ntm_ad[i].ad_name) - 1] = '\0';

git apply --check: OK. Supersedes/matches the finding markdown's proposal.

Phase 8 — single-fix ntfs.ko (hot-swap)

• git apply of fix.diff to in-guest /usr/src/sys/vfs/ntfs/ntfs_vfsops.c; rebuilt ntfs.ko (cd /usr/src/sys/vfs/ntfs && make, cc 8.3, rc=0 — fix_build.log); hot-swapped (kldunload → install → kldload, sha256 dbc96b6262bd579da8a7b050f490047048e6b5ed4f5fd338324d3848788e021d).

Benign image still mounts and parses attributes on the fixed module (functional regression check OK). → fix_status: fixed.