statfs/statvfs accounting overflow and unvalidated compat feature bits (has_journal RW without replay)
| Field | Value |
|---|---|
| ID | DF-3051 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CWE | CWE-190 / CWE-20 |
| File | sys/vfs/ext2fs/ext2_vfsops.c |
| Lines | 296-333, 1103-1129 |
| Area | vfs/ext2fs |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vfs |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
(a) ext2_statfs/ext2_statvfs compute overhead in uint32_t: gcount*overhead_per_group (itpg up to 32768 with isize==bsize) wraps; f_bavail = f_bfree − rbcount underflows when rbcount>fbcount (both only bounded by <=bcount); f_blocks can go negative — userland-visible accounting lies from crafted sb fields, no kernel memory impact. (b) ext2_check_sb_compat validates only incompat and ro_compat masks; compat bits are never checked, so EXT2F_COMPAT_HASJOURNAL images (ext3) mount read-write with no journal replay — silent on-disk corruption of legitimately dirty ext3 filesystems (Linux requires replay or norecovery). Not PoC-verified (Info). Fix: uint64 arithmetic with clamping; mask compat features and force read-only (or reject) has_journal filesystems that were not cleanly unmounted.
Timeline
- 2026-09-02 Discovered during pass-2 audit of ext2_vfsops.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3051 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 244 B | ↓ raw | |
| fix.diff | — | 2.4 KB | view raw | |
| manifest.json | — | 438 B | view raw | |
| verdict.json | — | 2.0 KB | view raw |
DF-3051 evidence pack
What
ext2 statfs/statvfs overflow + unvalidated compat bits (has_journal RW)
Verdict
status=not_reproduced impact=none confidence=certain
See VERDICT.md for the full narrative and fix.diff for the verified fix.
Fix verification
fixedjournal half A/B complete: ext3 image R/W mount now denied with an explicit journal warning; RO mount still allowed. Overflow half compile-validated (64-bit clamped math) by inspection + F40FIX build.
Confirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff
PoC changes
n/a - overflow half by inspection; journal half demonstrated via the DF-3217 image
Verified recommended fix
64-bit clamped statfs/statvfs arithmetic; deny R/W mount of HASJOURNAL images
Verdict
Line-accurate confirmation of both halves. (a) ext2_statfs/statvfs compute overhead and f_bavail in uint32_t (gcount*overhead_per_group wraps with itpg up to 32768; f_bavail = f_bfree - rbcount underflows - both fields declared uint32_t at ext2_vfsops.c:1092-1093/1152-1153, arithmetic at :1103-1129). (b) ext2_check_sb_compat (:296-331) never masks compat features, so EXT2F_COMPAT_HASJOURNAL (ext3) images mount read-write with no journal replay. The RW-journal half was exercised live through the DF-3217 rig (host mke2fs ext4 image carries has_journal): on the stock kernel the mount path never consults compat bits; on the F40FIX kernel the same image is refused for R/W with an explicit journal warning. Overflow half verified by arithmetic inspection + fixed with 64-bit clamped math; compiled in F40FIX (EXT2FS in kernel).
No comments yet.