Forged btree leaf with data_offset==0: hammer_btree_extract returns cursor->data==NULL with error==0 (CRC skipped) → NULL-deref kernel panics in readdir/readlink/nresolve/dounlink/strategy_read sinks on crafted HAMMER images
| Field | Value |
|---|---|
| ID | DF-3002 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-476 |
| File | sys/vfs/hammer/hammer_vnops.c |
| Lines | sinks :1734-1738, :1877-1880, :2866-2870, :1254-1255, :3343-3346 (root: hammer_btree.c:730) |
| Area | vfs/hammer |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vfs |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
hammer_btree_extract reports SUCCESS with a NULL data pointer for a crafted record leaf whose data_offset is 0 — the leaf/data CRC is never computed on this path, so a crafted image (attacker owns the media CRCs anyway) passes straight through. This file's sinks then dereference it: readdir vop_write_dirent(cursor.data->entry.obj_id/ name), readlink uiomove(cursor.data->symlink.name, data_len), strategy_read bcopy(cursor.data + roff), nresolve bcmp, dounlink bcmp/obj_id read. Deterministic NULL-page kernel panic, INVARIANTS or not (the KKASSERT passes for any data_len>7). Crafted-media local DoS: mount of a maliciously modified HAMMER image (vnconfig + mount -t hammer; requires privilege to mount, the DF-2902-2912 crafted-media threat model), then one getdents/readlink/unlink/strategy on the forged directory panics the kernel. Not run (Low, crafted-image class); sink reachability source-deterministic. Fix: return EINVAL for data_off==0 (one-liner in hammer_btree.c).
Timeline
- 2026-09-02 Discovered during pass-2 audit of hammer_vnops.c (GLM 5.3). DF-0769/DF-2698 re-verified, not re-reported.
No comments yet.