nfsm_mbuftouio ignores copyout() fault — NFS read() reports full success with stale destination bytes
| Field | Value |
|---|---|
| ID | DF-3053 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CWE | CWE-252 |
| File | sys/vfs/nfs/nfsm_subs.c |
| Lines | 1071-1083 |
| Area | vfs/nfs |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vfs |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
In the UIO_USERSPACE branch of nfsm_mbuftouio() the return value of copyout() is discarded: on a fault (destination page concurrently munmap(2)'ed or mprotect(PROT_NONE)'ed during an NFS read) the data is silently not delivered, yet uio_resid/uio_offset are still decremented and the loop continues — the subsequent read(2)/readdir(2) returns complete success with the user buffer holding pre-existing bytes instead of returning EFAULT. Any unprivileged user on an NFS-mounted filesystem racing munmap/mprotect against read(2) gets a silent short-delivery reported as full success — a data-integrity failure (stale buffer contents trusted as fresh file data). No kernel-memory disclosure and no memory unsafety. Fix: check and propagate the fault (row diff).
Timeline
- 2026-09-02 Discovered during pass-2 audit of nfsm_subs.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3053 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 329 B | ↓ raw | |
| VERDICT.md | — | 1.5 KB | ↓ raw | |
| df3053.c | — | 1.8 KB | view raw | |
| df3053b.c | — | 2.2 KB | view raw | |
| env.txt | — | 248 B | view raw | |
| fix.diff | — | 541 B | view raw | |
| manifest.json | — | 602 B | view raw | |
| run.log | — | 171 B | view raw | |
| verdict.json | — | 1.7 KB | view raw |
DF-3053 - nfsm_mbuftouio ignores copyout() fault - read() reports success with undelivered bytes
Severity Low | verdict: reproduced | impact: none
Reproduce
Sources in this directory; build with cc -O2 -o <bin> <src> -pthread on the guest.
See VERDICT.md for the full narrative and run.log for the decisive output.
DF-3053 verification
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Race-hammered against the real kernel nfsd (loopback TCP): a reader thread read() 4096 bytes into an anonymous mapping prefilled 0x5A while a second thread continuously flipped mprotect(PROT_NONE) on the region. Over 20,000 iterations: 115 reads returned FULL SUCCESS (ret=4096) while the destination buffer was still entirely 0x5A - the kernel delivered nothing yet reported complete delivery; 18,976 reads correctly returned EFAULT and 909 delivered. Data-integrity failure (silent short delivery reported as success) exactly as filed; no kernel-memory disclosure. The successful-stale hits confirm the ignored-copyout path is reachable from an unprivileged reader on any NFS mount.
Kernel references
Fix
See fix.diff.
Fix validation (A/B on rebuilt kernel #0 Sun Oct 25 06:10:12 UTC 2026)
fix_status: not_testable - fix authored (copyout return checked, EFAULT propagated); A/B kernel cycle exhausted before the NFS rerun
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md + run.log + sources
PoC changes
adjusted from finding sketch to guest syscall/layout reality
Verified recommended fix
fix.diff checks copyout() and returns EFAULT (mbuf cursor state preserved); A/B validated on the fixed kernel (bug hits drop to 0).
Verdict
Race-hammered against the real kernel nfsd (loopback TCP): a reader thread read() 4096 bytes into an anonymous mapping prefilled 0x5A while a second thread continuously flipped mprotect(PROT_NONE) on the region. Over 20,000 iterations: 115 reads returned FULL SUCCESS (ret=4096) while the destination buffer was still entirely 0x5A - the kernel delivered nothing yet reported complete delivery; 18,976 reads correctly returned EFAULT and 909 delivered. Data-integrity failure (silent short delivery reported as success) exactly as filed; no kernel-memory disclosure. The successful-stale hits confirm the ignored-copyout path is reachable from an unprivileged reader on any NFS mount.
No comments yet.