hammer_vop_setattr applies va_atime/va_mtime with no ownership/privilege check (VFS-contract divergence vs UFS): NFS SETATTR can forge timestamps on any file in an exported HAMMER1 filesystem
| Field | Value |
|---|---|
| ID | DF-3001 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CWE | CWE-863 |
| File | sys/vfs/hammer/hammer_vnops.c |
| Lines | 2345-2355 (contrast ufs_vnops.c:462-468) |
| Area | vfs/hammer |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vfs |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
hammer_vop_setattr writes ip->ino_data.atime/mtime from vap unconditionally. UFS enforces the VFS contract (owner OR SYSCAP_NOVFS_SETATTR OR VA_UTIMES_NULL+VWRITE); the local utimes syscall path is shielded by kern_utimensat's NLC_OWN|NLC_WRITE nlookup check, but in-kernel VOP_SETATTR callers — the NFS server (builds vap->va_atime/va_mtime straight from the RPC) — perform no such pre-check, so any NFS client with mapped credentials can set arbitrary atime/mtime on files it does not own in a HAMMER1 export. HAMMER1 analog of DF-2629 (filed for HAMMER2). Breaks backup/incremental/ forensic integrity; no kernel memory-safety impact. Fix: mirror ufs_setattr's check (row diff).
Timeline
- 2026-09-02 Discovered during pass-2 audit of hammer_vnops.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3001 · 11 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 661 B | ↓ raw | |
| VERDICT.md | — | 2.2 KB | ↓ raw | |
| build.sh | — | 54 B | view raw | |
| dfv_safe.c | — | 21.8 KB | view raw | |
| env.txt | — | 401 B | view raw | |
| fix.diff | — | 965 B | view raw | |
| fix_run.log | — | 279 B | view raw | |
| manifest.json | — | 605 B | view raw | |
| run.log | — | 330 B | view raw | |
| run.sh | — | 126 B | view raw | |
| verdict.json | — | 2.6 KB | view raw |
DF-3001 PoC evidence pack
What
hammer_vop_setattr applies va_atime/va_mtime with no ownership/privilege check (NFS SETATTR forge).
Build
make (KMOD dfv_safe)
Run
mount hammer1+ufs rigs; kldload dfv_safe.ko; sysctl -w dfv.sa3001=1
Expected
HAMMER: VOP_SETATTR non-owner -> 0, mtime forged; UFS control -> EPERM
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 All logs are full untrimmed captures unless noted. fix.diff is the git-apply-able verified fix (authored after verification; never applied to the audit tree).
DF-3001 - verification verdict
Status: reproduced | reproduced: 1 | impact: corruption | confidence: certain
Missing ownership check proven at the exact VFS layer the NFS server drives, with a UFS control. A kernel probe issued VOP_SETATTR(va_atime/va_mtime = 1234567890, va_vaflags=0, credential uid 32767 nobody) on a root-owned 0644 file: HAMMER1 returned 0 and the mtime WAS forged to 1234567890 (hammer_vop_setattr applies va_atime/va_mtime unconditionally, hammer_vnops.c:2344-2350); the identical probe against UFS returned EPERM with mtime unchanged (the ufs_setattr contract guard, ufs_vnops.c:462-468, that hammer omits). The NFS server builds vap->va_atime/va_mtime straight from the RPC (nfs_serv.c:391-399) and calls VOP_SETATTR with the mapped client credential, so any NFS client with mapped credentials can forge timestamps on files it does not own in a HAMMER1 export; the local syscall path is shielded by the client-side NLC check. Raw-RPC end-to-end not driven (no scripting runtime on guest; timeboxed) - the VOP-layer A/B is the mechanism proof. Fix (mirror the UFS guard) A/B validated on the fix-all kernel.
Evidence pointers
run.log DF3001: hammer mtime 1792879535 -> 1234567890 FORGED; UFS control -> 1 (EPERM) rejected
Kernel references
PoC changes vs the filing sketch
VOP-layer probe with a forged non-owner credential instead of a raw NFS RPC client (no python on guest); threat-model reachability from nfs_serv.c source
Fix
recommendation: mirror ufs_setattr ownership/privilege check for atime/mtime
fix status: fixed
A/B on fix-all kernel: non-owner probe returns EPERM, mtime unchanged (pending final session confirm)
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
fixedA/B on fix kernel #2: non-owner VOP_SETATTR on HAMMER returns EPERM with mtime unchanged, matching the UFS control (stock forged mtime to 1234567890).
Confirmed kernel references
Detail
Exploit chain
NFS SETATTR RPC -> nfs_serv builds vap with client-supplied atime/mtime + mapped unpriv cred -> VOP_SETATTR -> hammer applies with no ownership check -> timestamps forged on non-owned files
Evidence (decisive lines)
run.log DF3001: hammer mtime 1792879535 -> 1234567890 FORGED; UFS control -> 1 (EPERM) rejected
PoC changes
VOP-layer probe with a forged non-owner credential instead of a raw NFS RPC client (no python on guest); threat-model reachability from nfs_serv.c source
Verified recommended fix
mirror ufs_setattr ownership/privilege check for atime/mtime
Verdict
Missing ownership check proven at the exact VFS layer the NFS server drives, with a UFS control. A kernel probe issued VOP_SETATTR(va_atime/va_mtime = 1234567890, va_vaflags=0, credential uid 32767 nobody) on a root-owned 0644 file: HAMMER1 returned 0 and the mtime WAS forged to 1234567890 (hammer_vop_setattr applies va_atime/va_mtime unconditionally, hammer_vnops.c:2344-2350); the identical probe against UFS returned EPERM with mtime unchanged (the ufs_setattr contract guard, ufs_vnops.c:462-468, that hammer omits). The NFS server builds vap->va_atime/va_mtime straight from the RPC (nfs_serv.c:391-399) and calls VOP_SETATTR with the mapped client credential, so any NFS client with mapped credentials can forge timestamps on files it does not own in a HAMMER1 export; the local syscall path is shielded by the client-side NLC check. Raw-RPC end-to-end not driven (no scripting runtime on guest; timeboxed) - the VOP-layer A/B is the mechanism proof. Fix (mirror the UFS guard) A/B validated on the fix-all kernel.
No comments yet.