DF-3106 — VERDICT

Status: reproduced (memory corruption, then panic). Impact at PoC level: panic with a fully-characterized kernel heap OOB write. Confidence: certain.

Root cause

ufs_lookup()'s slot search validates each walked entry only for forward progress — d_reclen != 0 && d_reclen <= DIRBLKSIZ - (off & (DIRBLKSIZ-1)) (sys/vfs/ufs/ufs_lookup.c:264-266). Full validation (ufs_dirbadentry(): d_reclen >= DIRSIZ(fmt,ep), namlen <= MAXNAMLEN, NUL-termination) runs only when debug.dircheck (= dirchk) is nonzero, and dirchk is 0 on stock kernels (#ifdef DIAGNOSTIC only; sys/vfs/ufs/ufs_lookup.c:64-68; verified debug.dircheck: 0 on the audit guest).

ufs_direnter()'s compaction loop (sys/vfs/ufs/ufs_lookup.c:808-844) then re-walks that region trusting d_namlen:

dsize = DIRSIZ(OFSFMT(dvp), nep);        /* :831 — up to 264 for namlen 255 */
spacefree += nep->d_reclen - dsize;
...
bcopy((caddr_t)nep, (caddr_t)ep, dsize); /* :843 — ep advances by dsize */

A crafted entry with d_reclen=4/8 and d_namlen=255 passes the walk (reclen small but nonzero and within the dirblock), contributes nothing to the slot accounting (size = reclen - DIRSIZ <= 0, skipped at :287), yet in direnter each such entry copies 264 bytes and advances the destination pointer 264 bytes while the source chain advances only 4-8. The destination runs (region/4)*264 bytes past the directory buffer.

The panic("ufs_direnter: compact1/compact2") safety nets (:857-862) are checked only after the loop — the OOB writes are unconditional, and with

= 2 poison entries spacefree = Σreclen − Σdsize ≤ 512 − 528 < newentrysize, so the panic is guaranteed after the corruption (corruption-then-panic).

Reproduction (baseline kernel #0, stock INVARIANTS X86_64_GENERIC)

Crafted image: newfs -b 4096 -f 512, directory /d = one 512-byte fragment (di_size=512, di_db[0]), dirblock poisoned by patch_dir:

• variant A (precise): [e0 free reclen 168][e1 poison reclen 8 namlen 255] [e2 free reclen 4][W-fill {04 00 00 FF}*] with a chain that ends exactly at 512; region = [0,180) chosen COMPACT by a 160-char create name (DIRECTSIZ(160)=172).
• variant B (massive): W-fill poisons across [168,496), free trigger @500 reclen 12; region = [0,512); ~86 live iterations.

Observed:

• Variant A — panic: ufs_direnter: compact2, backtrace ufs_direnter ← ufs_makeinode ← ufs_create ← vop_old_create (panicA.txt, runA.log). Derivation of the write: iter1 bcopy lands at dirbuf+0..264 (in-bounds); iter2 lands at dirbuf+264..528 in a 512-byte buffer → 16 bytes OOB write, then the loop exits (loc=180=i_count) and the post-loop check panics compact2 (spacefree = 168+(8−264)+(4−264) = −348 < 172; ep->d_ino != 0 because the OOB bcopy itself wrote W bytes there). The panic is only reachable through >= 2 compacted entries with DIRSIZ >> reclen — impossible on a valid filesystem.
• Variant B — Fatal trap 12: page fault while in kernel mode, fault code = supervisor write data, page not present, stopped at memmove+0x32 (panicB.txt, runB.log) — the compaction bcopy itself faulted writing at 0xfffff80053b07000 after walking ~22.7KB (86 × 264B) past the 512-byte fragment buffer. The write walked through adjacent kernel heap (buffer-cache memory) until an unmapped page.

Trigger ran as the unprivileged user maxx (root only mounts the image; the only authorization is VOP_EACCESS(VWRITE) at :378, satisfied by mode 0777 on /d).

Primitive characterization

• What: repeated 264-byte bcopys of attacker-crafted on-disk bytes (arbitrary content, NULs allowed — raw disk data).
• Where: forward from the end of a kernel buffer-cache fragment buffer (512B, 1KB, ... — attacker picks the fs geometry); deterministic offsets (264-byte multiples).
• Extent: attacker-chosen number of iterations (region layout) × 264 bytes; variant B demonstrated ~22.7KB past a 512B buffer.
• Limit: the guaranteed post-loop panic means the corrupting thread dies right after the writes — exploitation to uid=0 would need a second CPU to consume the corrupted heap objects in the window before the panic completes (SMP consumers of buffer-cache neighbors), or the corruption to land in data whose consumer runs concurrently. Not pursued to uid=0 in this run; the primitive (control + extent + content) is fully established.

Fix validation

fix.diff adds entry validation to the compaction loop (reclen != 0, reclen within region, reclen >= DIRSIZ for live entries; on failure B_INVAL + brelse + EIO). Applied to the guest's /usr/src, make nativekernel (KERNEL_RC=0) + installkernel (INSTALL_RC=0), reboot into kernel #1:

• Variant A: touch: ...: Input/output error (EIO), no panic, guest up (runA.patched.log).
• Variant B: same clean EIO, no page fault, no panic, guest up (runB.patched.log).
• Regression on the patched kernel: 40 create / 20 delete / 30 create in a normal UFS dir (exercises the compaction path) → 50 files, all good — valid-directory compaction is unaffected.

Notes

• The walk itself has a smaller adjacent flaw demonstrated during PoC development: an entry header starting within 8 bytes of the buffer end makes ep->d_reclen (checked at :264) read up to 6 bytes past the buffer (OOB read feeding only the bounds check). Same trust-gap family; not separately IDed.
• ufs_dirbad() panicking on RW-mounted corrupted directories is tracked separately as DF-3083's UFS instance (DF-3108).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.