Summary

ntfs_uncompunit walks the compression unit block-by-block, accumulating off += new where new = len+3 is attacker-controlled (3..4098). It never checks that off, nor the within-block GET_UINT16 reads at cbuf+cpos, stay within the cup input buffer. For the last block(s) of a unit the reads overshoot cup, producing a kernel heap OOB read of attacker-influenced size; the bytes feed the decompression state and some reach userspace.

Root cause

ntfs_compr.c:105:

for (i = 0; i * NTFS_COMPBLOCK_SIZE < ntfs_cntob(NTFS_COMPUNIT_CL); i++) {
    new = ntfs_uncompblock(uup + i * NTFS_COMPBLOCK_SIZE, cup + off);
    if (new == 0)
        return (EINVAL);
    off += new;
}

iterates a fixed number of 4096-byte output blocks based on the output buffer size, not the input. At ntfs_compr.c:106 it passes cup + off as the input with no check that off is within [0, cup_size). At ntfs_compr.c:109 off += new (new = len+3, len = GET_UINT16(cup+off) & 0xFFF, range 0..4095 → new in 3..4098) accumulates without bound.

For a 64 KB compression unit (16 × 4096-byte clusters, the common NTFS layout) there are 16 blocks; if each block claims len=4095 (new=4098), off reaches 16*4098 = 65568 > 65536. Inside the 16th block, ntfs_compr.c:55 len = GET_UINT16(cbuf) reads at cup+61470 (in bounds), but ntfs_compr.c:71 cbuf[cpos++] and ntfs_compr.c:79-80 GET_UINT16(cbuf + cpos) walk cpos up to len+2 = 4097, so the reads touch cup[61470+4097] = cup[65567] and the 2-byte GET_UINT16 at cpos=len+2 reads cup[65568..65569] — 32+ bytes past the end of the cup allocation. (For an 8 KB unit / 2 blocks, the same arithmetic overruns by ~6 bytes.)

No input-length parameter is passed to ntfs_uncompblock, so even a per-block check is currently impossible.

Threat model & preconditions

• Attacker position: Anyone who can deliver a crafted NTFS image.
• Privileges gained or impact: Kernel heap OOB read (info disclosure of the slab neighbor of cup) and a kernel panic if the over-read crosses a page boundary into an unmapped region. OOB magnitude is small (tens of bytes) but attacker-steerable; on most configs it lands in an adjacent mapped slab object and leaks.
• Required config or capabilities: Same mounting precondition as DF-0932.
• Reachability: mount -t ntfs + read() of the compressed file.

Proof of concept

PoC source: findings/poc/DF-0934/

Build & run

# 1. mkfs.ntfs a >=1 MB image; create a file large enough to occupy one
#    full 16-cluster compression unit (>= 64 KB with default 4 KB
#    clusters) and mark it compressed so its $DATA attribute is stored
#    as a single compressed compression unit run.
# 2. Offline-patch every 4096-byte-aligned block header in that
#    compression unit on disk to 0xFF 0x8F (GET_UINT16 = 0x8FFF:
#    bit15 set, len = 0xFFF = 4095, so each ntfs_uncompblock returns
#    new = 4098). Pad each block's payload to len+1 = 4096 bytes of
#    benign tokens (e.g. all-literal ctag 0x00 bytes) so the decoder
#    does not fault mid-block; only the final block's trailing reads
#    need to overreach.
python3 patch_img.py base.ntfs evil.ntfs

# 3. Mount and read:
mount -t ntfs -o ro evil.ntfs /mnt
dd if=/mnt/file of=/dev/null    # any reader

Expected output

Either a kernel panic (panic.txt with a fault in ntfs_uncompblock, e.g. page-fault-on-read at cup_size + small delta), or — if the adjacent slab is mapped — subtly wrong decompression output whose tail bytes are heap content. Confirm by reading the same file repeatedly under varying slab pressure.

Impact

Local kernel heap info leak (slab neighbor of cup) and/or local DoS (panic when the over-read crosses a page boundary).

Recommended fix

Bound the accumulated input offset against the compression-unit size in ntfs_uncompunit, and give ntfs_uncompblock the remaining input length so it can reject streams that overrun it. Minimal immediate guard:

--- a/sys/vfs/ntfs/ntfs_compr.c
+++ b/sys/vfs/ntfs/ntfs_compr.c
@@ -103,9 +103,16 @@ ntfs_uncompunit(
    int             off = 0;
    int             new;

+   int     cusize = ntfs_cntob(NTFS_COMPUNIT_CL);
    for (i = 0; i * NTFS_COMPBLOCK_SIZE < ntfs_cntob(NTFS_COMPUNIT_CL); i++) {
+       if (off + 2 > cusize)       /* need a 2-byte block header */
+           return (EINVAL);
        new = ntfs_uncompblock(uup + i * NTFS_COMPBLOCK_SIZE, cup + off);
        if (new == 0)
            return (EINVAL);
        off += new;
+       if (off > cusize)           /* block ran past end of input */
+           return (EINVAL);
    }
    return (0);
 }

Complete fix: change ntfs_uncompblock's signature to accept the remaining input length and, after reading len = GET_UINT16(cbuf) & 0xFFF, validate len + 3 <= remaining (return 0/EINVAL otherwise), and replace every GET_UINT16(cbuf + cpos)/cbuf[cpos] with a check that cpos + 2 <= remaining. This closes the within-block over-read that the minimal guard above does not fully prevent.

References

• sys/vfs/ntfs/ntfs_subr.c:1687-1690 — cup allocation (kmalloc M_NTFSDECOMP, M_WAITOK).
• sys/vfs/ntfs/ntfs_compr.c:55,71,79-80 — the unbounded GET_UINT16 / cbuf[cpos] reads.

Timeline

• 2026-07-05 Discovered during automated audit.
• pending Reported to DragonFlyBSD security contact.