NFSSVC_MNTD path type-confuses any filesystem's mount into struct nfsmount: VROOT check without vfstype check before VFSTONFS(vp->v_mount)
Summary
The NFSSVC_MNTD branch resolves ncd.ncd_dirp and only checks (vp->v_flag & VROOT) before casting nmp = VFSTONFS(vp->v_mount) - i.e. mp->mnt_data of ANY filesystem (the root of a UFS/HAMMER2 mount passes VROOT). The bogus struct nfsmount* is handed to nfs_clientd() (nfs_kerb.c:70), which reads nm_state, publishes ncd data from nm_* fields to the caller (kernel-memory disclosure of foreign mount structures), and on NFSSVC_GOTAUTH copyin()s attacker-length data into nmp->nm_authstr/nmp->nm_verfstr - pointers read out of foreign mount data -> wild kernel writes; it also tsleeps on garbage and can dounmount() the confused mount. Requires root (nfssvc privilege gate), so intra-kernel type confusion available to an already-privileged user (relevant to jailed/separated daemon contexts granted SYSCAP_RESTRICTEDROOT). Skipped guest verification (Low, privileged-only). Fix: validate mnt_vfc == &nfs_vfsconf before the cast. [VERIFIED pass2: type confusion exercised as root - confused reads route to benign early exits, no crash or disclosure; missing-vfstype-check code-real]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3090 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 315 B | ↓ raw | |
| VERDICT.md | — | 1.3 KB | ↓ raw | |
| df3090.c | — | 1.4 KB | view raw | |
| env.txt | — | 248 B | view raw | |
| fix.diff | — | 120 B | view raw | |
| manifest.json | — | 566 B | view raw | |
| run.log | — | 194 B | view raw | |
| verdict.json | — | 1.6 KB | view raw |
DF-3090 - NFSSVC_MNTD type-confuses any filesystems mount into struct nfsmount
Severity Low | verdict: not_reproduced | impact: none
Reproduce
Sources in this directory; build with cc -O2 -o <bin> <src> -pthread on the guest.
See VERDICT.md for the full narrative and run.log for the decisive output.
DF-3090 verification
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Line-verified confusion exercised as root with the guest hammer2 root mount: nfssvc(NFSSVC_MNTD, {"/"}) and nfssvc(NFSSVC_MNTD|NFSSVC_GOTAUTH, ...) both return 0 cleanly - the type-confused reads of hammer2 mount data through struct nfsmount field offsets happen (nmp = VFSTONFS(vp->v_mount) with only a VROOT check, nfs_syscalls.c:175-176), but the garbage field values route execution into benign early exits (the NFSSTA_MNTD early-return at :180 for the plain call; an authstr NULL path for GOTAUTH) on this filesystem layout. No crash, no observable disclosure, no wild write manifested. Missing vfstype validation is real; impact not demonstrable on this guest.
Kernel references
Fix
See fix.diff.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md + run.log + sources
PoC changes
adjusted from finding sketch to guest syscall/layout reality
Verified recommended fix
diff: validate vp->v_mount->mnt_vfc == &nfs_vfsconf (or equivalent type check) before the VFSTONFS cast, else EINVAL.
Verdict
Line-verified confusion exercised as root with the guest hammer2 root mount: nfssvc(NFSSVC_MNTD, {"/"}) and nfssvc(NFSSVC_MNTD|NFSSVC_GOTAUTH, ...) both return 0 cleanly - the type-confused reads of hammer2 mount data through struct nfsmount field offsets happen (nmp = VFSTONFS(vp->v_mount) with only a VROOT check, nfs_syscalls.c:175-176), but the garbage field values route execution into benign early exits (the NFSSTA_MNTD early-return at :180 for the plain call; an authstr NULL path for GOTAUTH) on this filesystem layout. No crash, no observable disclosure, no wild write manifested. Missing vfstype validation is real; impact not demonstrable on this guest.
No comments yet.