DF-3075

nfs_statfs/nfs_statvfs apply server-claimed filesystem geometry unvalidated: v3 f_blocks/f_bfree/f_bavail cast (long)(u_quad/1024) can go negative, v2 f_bsize is an arbitrary server int, statvfs 64-bit fields unclamped

Summary

A malicious NFS server controls sf_tbytes/sf_fbytes/sf_abytes (64-bit) and the v2 sf_bsize/sf_blocks fields; nfs_statfs casts tquad/1024 to (long) (:360-364) so a claimed total > 2^63*1024 yields negative f_blocks (userland df/quotas see nonsense), v2 f_bsize applied raw (:370), nfs_statvfs copies unclamped 64-bit values (:446-454). Purely userland-visible display/ceiling metadata - no kernel allocation or bound derives from these values (f_iosize deliberately frozen, :378-387). Not verified (Info). Fix: clamp to sane ranges. [VERIFIED pass2: unvalidated server-claimed geometry confirmed; no malicious server for Info tier; LONG_MAX clamps compiled]

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — filesystems
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
CWE: CWE-20
File: sys/vfs/nfs/nfs_vfsops.c
Lines: 357-463
Area: vfs
Discovered: 2026-09-06
Updated: 2026-09-06

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-10-26 04:39:03
Attempts: 0
Runtime: 30s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: see build.sh
Run cmd: see run.sh

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-26 04:39:03
Runtime: —
Kernel: per-fix-DF-3075
fix.diff: findings/poc/DF-3075/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3075 · 4 files

File	Type	Size
README.md	—	233 B	↓ raw
fix.diff	—	2.8 KB	view raw
manifest.json	—	386 B	view raw
verdict.json	—	1.5 KB	view raw

README.md

↓ download raw

DF-3075 evidence pack

What

nfs_statfs/statvfs apply server-claimed geometry unvalidated

Verdict

status=not_reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

not_testable

fix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)

↓ fix.diffper-fix-DF-3075

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a - no malicious NFS server stood up for Info tier

Verified recommended fix

clamp v3 geometry to LONG_MAX, clamp v2 f_bsize to [DEV_BSIZE,MAXBSIZE]

Verdict

Line-accurate confirmation; no runtime demonstration (would require a malicious NFS server; disproportionate for Info tier). nfs_statfs v3 casts (long)(fxdr_hyper/1024) at nfs_vfsops.c:360-364 - a claimed total above 2^63*1024 yields negative f_blocks; the v2 branch applies server sf_bsize raw (:370-373); nfs_statvfs copies unclamped 64-bit values (:446-454). No kernel allocation derives from these (f_iosize frozen at :378-387). Fix (LONG_MAX clamps + bsize sanity clamp) compiled in the F40FIX build (NFS in kernel).