Vendored LZ4 is upstream r97 (2013) — 13 years of upstream hardening absent (cross-reference; upstream-owned history)
| Field | Value |
|---|---|
| ID | DF-2665 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-1104 Use of Unmaintained Third Party Components |
| File | sys/vfs/hammer2/hammer2_lz4.c |
| Lines | 372-517 (decoder = verbatim r97), encoder header r96-era |
| Area | vfs |
| Confidence | certain |
| Discovered | 2026-08-29 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | hammer2 |
| Reported | pending |
| Known CVE | CVE-2014-4610 (structurally unreachable: 32-bit only; sys/platform has only pc64/vkernel64) |
| CVE match | variant |
Summary
Version pinning: the decompressor in hammer2_lz4.c:372-517 is a verbatim
logic copy of upstream LZ4 r97 (svn trunk@97, 2013-06-10 — imported for
hammer2 the same day); the encoder header matches r96-era. Never
re-synced. Missing upstream changes assessed for this tree: (1)
CVE-2014-4610 fix (r118) — 32-bit only, structurally unreachable on
DragonFly's LP64-only platforms; (2) r110+ empty-block special case and
later bounded readers with explicit overflow detection — LP64 safety
already provided by the existing margin discipline (fuzz-confirmed);
(3) v1.9.4's srcSize==0 guard — the one fix that matters even on
LP64, missing here (filed as DF-2664); (4) r116+ table reorganization —
equivalent semantics on x86-64; (5) FAST_DEC_LOOP / streaming APIs —
performance/features.
Threat
No incremental exposure on LP64 beyond DF-2664; forward-looking risk (future refactors or new callers inherit un-audited 2013 parsing code; any future 32-bit port would acquire CVE-2014-4610).
Recommended fix
Re-vendor the current upstream lz4.c decompression core (v1.9.4+) or
cherry-pick the two post-r97 safety guards (the inputSize==0 guard —
already in DF-2664's fix.diff — and the literal/match-length overflow
checks). Track upstream LZ4 advisories for the vendored copy as done
for sys/contrib/.
Timeline
- 2026-08-29 Recorded during pass-2 audit of hammer2_lz4.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2665 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.9 KB | ↓ raw | |
| README.md | — | 248 B | ↓ raw | |
| build.sh | — | 85 B | view raw | |
| run.sh | — | 49 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 597 B | view raw | |
| verdict.json | — | 2.1 KB | view raw |
DF-2665 evidence pack
- finding: sys/vfs/hammer2/hammer2_lz4.c (372-517)
- verdict: reproduced (certain) - see VERDICT.md
- source-only confirmation (no runtime PoC)
- reproduce: build.sh / run.sh
- fix.diff: documented recommendation (no diff)
DF-2665 - Verification Verdict
Status: reproduced Impact: none (hardening) Confidence: certain
Mechanism
The vendored LZ4 decompressor is the 2013-era r97 codebase: LZ4_decompress_generic with the pre-hardening overflow accounting, no LZ4_compress_default fast-path bounds API, none of the 13 years of upstream CVE fixes (e.g. the CVE-2014-4610-class read-overrun fixes in r118+).
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Cross-reference item (upstream-owned): version identity confirmed against the r97-era source layout. DragonFly wraps every decompress call with a strict output-size bound (hammer2_lz4.c LZ4_decompress_safe into caller-sized buffers, comp block header caps), so the known r97 decoder overread classes are contained by the wrapper bounds; the real fix is syncing the vendored file to current upstream lz4 (r1.9.x+) - out of scope for a one-off fix.diff, so this pack carries a documented recommendation only, per the contrib/vendored policy.
Threat / reachability
Vendored-code age: upstream hardening absent; wrapper bounds currently contain the known overread classes.
Privilege escalation assessment
n/a (hardening)
Fix
Documented recommendation (no fix.diff): sync sys/vfs/hammer2/hammer2_lz4.c to current upstream LZ4 (upstream-owned history).
Kernel references
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
(No fix.diff for this item: documented recommendation only - see Fix above.)
Fix verification
not_testableNo fix.diff (documented recommendation in VERDICT.md): Documented recommendation (no fix.diff): sync sys/vfs/hammer2/hammer2_lz4.c to current upstream LZ4 (upstream-owned history).
n/a (recommendation item)
Confirmed kernel references
Detail
Exploit chain
no escalation path (Info-tier hardening; see VERDICT.md)
Evidence (decisive lines)
VERDICT.md mechanism/verdict sections; fix.diff
PoC changes
none (source-only confirmation for this Info-tier item)
Verified recommended fix
Documented recommendation (no fix.diff): sync sys/vfs/hammer2/hammer2_lz4.c to current upstream LZ4 (upstream-owned history).
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Cross-reference item (upstream-owned): version identity confirmed against the r97-era source layout. DragonFly wraps every decompress call with a strict output-size bound (hammer2_lz4.c LZ4_decompress_safe into caller-sized buffers, comp block header caps), so the known r97 decoder overread classes are contained by the wrapper bounds; the real fix is syncing the vendored file to current upstream lz4 (r1.9.x+) - out of scope for a one-off fix.diff, so this pack carries a documented recommendation only, per the contrib/vendored policy.
No comments yet.