DF-3001
hammer_vop_setattr applies va_atime/va_mtime with no ownership/privilege check (VFS-contract divergence vs UFS): NFS SETATTR can forge timestamps on any file in an exported HAMMER1 filesystem
| Field | Value |
|---|---|
| ID | DF-3001 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CWE | CWE-863 |
| File | sys/vfs/hammer/hammer_vnops.c |
| Lines | 2345-2355 (contrast ufs_vnops.c:462-468) |
| Area | vfs/hammer |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vfs |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
hammer_vop_setattr writes ip->ino_data.atime/mtime from vap unconditionally. UFS enforces the VFS contract (owner OR SYSCAP_NOVFS_SETATTR OR VA_UTIMES_NULL+VWRITE); the local utimes syscall path is shielded by kern_utimensat's NLC_OWN|NLC_WRITE nlookup check, but in-kernel VOP_SETATTR callers — the NFS server (builds vap->va_atime/va_mtime straight from the RPC) — perform no such pre-check, so any NFS client with mapped credentials can set arbitrary atime/mtime on files it does not own in a HAMMER1 export. HAMMER1 analog of DF-2629 (filed for HAMMER2). Breaks backup/incremental/ forensic integrity; no kernel memory-safety impact. Fix: mirror ufs_setattr's check (row diff).
Timeline
- 2026-09-02 Discovered during pass-2 audit of hammer_vnops.c (GLM 5.3).
No comments yet.