Kernel heap-pointer (%p) kprintf disclosures on four hammer2 inode error paths
| Field | Value |
|---|---|
| ID | DF-2637 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CWE | CWE-200 Exposure of Sensitive Information |
| File | sys/vfs/hammer2/hammer2_inode.c |
| Lines | 711-712, 1726, 1761-1762, 1800-1801 |
| Area | vfs |
| Confidence | certain |
| Discovered | 2026-08-29 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | hammer2 |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
Four kprintf sites print raw kernel inode/vnode addresses on
runtime-reachable error paths: igetv race %p/%p (:711-712,
lookup/vnode-allocation races), unable to fsync inode %p (:1726,
backend chain_sync failures — reachable via ENOSPC pressure per DF-2633),
backend unable to insert inode %p (:1761-1762) and
backend unable to delete inode %p (:1800-1801). dmesg is readable by
unprivileged users on stock DragonFly, so these leak slab-object
addresses that aid heap grooming when combined with any
address-dependent primitive. Same class as DF-2614; distinct sites.
Proof of concept
Trigger sketch (guest-run intentionally skipped per contract — Low): hammer the same path with concurrent lookups to hit the igetv race, or fill the PFS and fsync in a loop (DF-2633 shows the backend failure storm fires :1761 at 213 lines/s); grep dmesg for the messages.
Recommended fix
Print the inum instead of the pointer at all four sites, e.g.
kprintf("hammer2: unable to fsync inode %ld\n", (long)ip->meta.inum);
References
- DF-2614 (same class, iocom sites), DF-2633 (drives :1761)
Timeline
- 2026-08-29 Discovered during pass-2 audit of hammer2_inode.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2637 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 1.4 KB | ↓ raw | |
| verdict.json | — | 1.2 KB | view raw | |
| manifest.json | — | 631 B | view raw |
DF-2637 — kernel heap-pointer (%p) disclosures in hammer2_inode error paths
What
Four kprintf("%p") sites in sys/vfs/hammer2/hammer2_inode.c print raw
kernel inode/vnode addresses to the console/msgbuf on error paths that can
be reached at runtime:
- hammer2_inode.c:711-712 —
kprintf("hammer2: igetv race %p/%p\n", ip->vp, vp) - hammer2_inode.c:1726 —
kprintf("hammer2: unable to fsync inode %p\n", ip) - hammer2_inode.c:1761-1762 —
kprintf("hammer2: backend unable to insert inode %p %ld\n", ...) - hammer2_inode.c:1800-1801 —
kprintf("hammer2: backend unable to delete inode %p %ld\n", ...)
The msgbuf is readable by unprivileged users via dmesg (world-readable
kernel message buffer on stock DragonFly). Combined with a separate
heap-address leak primitive, this defeats heap-layout randomization for
slab-grooming attacks; on its own it is a hardening issue (CWE-200 /
CWE-497). Same class as DF-2614 (iocom %p leaks), distinct sites.
Trigger sketch
Repeated lookup/igetv races or fsync failures (e.g. ENOSPC-pressure on a full PFS, per DF-2633 write failures surface here as fsync errors) print the addresses. Not guest-verified this run (Low severity; skipped per audit contract — see verdict.json).
Fix
Drop the %p (or print the inum only):
- kprintf("hammer2: unable to fsync inode %p\n", ip);
+ kprintf("hammer2: unable to fsync inode %ld\n", (long)ip->meta.inum);
(and equivalents at the other three sites).
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
README.md quotes all four sites with path:line
Verified recommended fix
Drop %p from the four kprintfs; print meta.inum instead.
Verdict
Low-severity hardening finding: four kprintf %p sites in hammer2_inode.c (igetv race at :711, fsync failure at :1726, chain insert failure at :1761, chain delete failure at :1800) print kernel inode/vnode addresses to the console/msgbuf on error paths reachable at runtime; dmesg is readable by unprivileged users on stock DragonFly. Guest verification intentionally skipped per audit contract (Low/Info).
No comments yet.