ufs_check_export hands out &np->netc_anon after dropping NE_LOCK — concurrent export update (mount -u MNT_DELEXPORT) frees the netcred while nfsrv_fhtovp still reads the embedded credential across a window that includes VFS_FHTOVP disk I/O: UAF read feeding garbage uid/groups into the NFS root-squash mapping
Summary
vfs_export_lookup() returns the matched netcred after releasing NE_LOCK; ufs_check_export then exports '&np->netc_anon'. nfsrv_fhtovp() reads credanon->cr_uid/cr_ngroups/cr_groups only AFTER running VFS_FHTOVP, which may block on disk I/O - a wide window during which vfs_export() -> MNT_DELEXPORT -> vfs_free_addrlist() rn_flush+kfrees the netcred. The anon cred is embedded in the freed allocation so no refcount can save it. An unauthenticated NFS client racing a root-triggered export change: the squashed credential is read from freed kernel memory - wrong uid/groups (pathologically uid 0 if recycled favorably) applied to the NFS request, or a fault if the page is handed back. Requires privileged cooperation on the free side, hence Low. Not PoC'd (Low, privileged free-side actor); line-accurate source chain. Fix: copy exflags/anon-cred out under NE_LOCK (crdup-style) and hand the caller an owned credential. [VERIFIED pass2: privileged free-side actor required; UAF window line-certain; crdup fix compile-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3242 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | — | 1.0 KB | view raw | |
| README.md | — | 409 B | ↓ raw | |
| VERDICT.md | — | 1.7 KB | ↓ raw | |
| build.sh | — | 106 B | view raw | |
| run.sh | — | 124 B | view raw | |
| manifest.json | — | 470 B | view raw | |
| verdict.json | — | 1.4 KB | view raw | |
| fix.diff | — | 1.0 KB | view raw | |
| env.txt | — | 272 B | view raw |
DF-3242 -- verification pack
Finding: ufs_check_export hands out the anon cred after dropping NE_LOCK (UAF window)
Status: not_reproduced / impact leak / confidence certain
What was run
n/a
How to reproduce
n/a (needs export churn racing NFS requests)
Expected
n/a
See VERDICT.md for the full narrative and verdict.json for the persisted machine verdict. Artifacts: fix.diff.
DF-3242 verification
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Bottom line
UAF window certain by inspection but gated on the privileged free side: vfs_export_lookup returns the matched netcred after releasing NE_LOCK, ufs_check_export hands out &np->netc_anon, and nfsrv_fhtovp reads cr_uid/cr_ngroups/cr_groups only after VFS_FHTOVP (which may block on disk I/O) - during which vfs_export (mount -u -o -export) frees the netcred, so the squashed credential is read from freed memory (wrong uid/groups, pathologically uid 0, or a fault). A faithful reproduction needs a root actor toggling exports against live NFS traffic; the free side makes it a correctness hazard rather than an attack. Fix copies the anon cred out under the lock (crdup) with the matching crfree in nfsrv_fhtovp; compile-validated.
Kernel references
Exploit chain
(none: availability/correctness finding; no privilege chain)
Fix
crdup the anon credential; crfree it in nfsrv_fhtovp
See fix.diff in this directory (git-apply-able against the read-only sys/ tree; applied only inside the disposable verification guest).
Reproduction
build: n/a
run: n/a (needs export churn racing NFS requests)
expected: n/a
Notes on the PoC (what changed vs the finding sketch)
(none)
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md walk over ufs_vfsops.c:246-251 and nfs_subs.c:1238/:1272-1275
Verified recommended fix
crdup the anon credential; crfree it in nfsrv_fhtovp
Verdict
UAF window certain by inspection but gated on the privileged free side: vfs_export_lookup returns the matched netcred after releasing NE_LOCK, ufs_check_export hands out &np->netc_anon, and nfsrv_fhtovp reads cr_uid/cr_ngroups/cr_groups only after VFS_FHTOVP (which may block on disk I/O) - during which vfs_export (mount -u -o -export) frees the netcred, so the squashed credential is read from freed memory (wrong uid/groups, pathologically uid 0, or a fault). A faithful reproduction needs a root actor toggling exports against live NFS traffic; the free side makes it a correctness hazard rather than an attack. Fix copies the anon cred out under the lock (crdup) with the matching crfree in nfsrv_fhtovp; compile-validated.
No comments yet.