DragonFlyBSD Kernel Audit
DF-1141 / run.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-1141 runtime trigger is NOT exercisable on this guest.
#
# The vulnerable code (ci_setup_default_dpm_tables in amdgpu ci_dpm.c) runs
# only when the amdgpu driver attaches to a Sea Islands (Bonaire/Hawaii)
# AMD GPU and parses its VBIOS PowerPlay tables at DPM init. This QEMU/KVM
# guest has no AMD GPU (only QEMU std VGA 0x1234:0x1111), and amdgpu is not
# in the GENERIC kernel, so the path is unreachable here.
#
# Realistic threat model (physical HW / VFIO passthrough / reflashed VBIOS):
#   A malicious/reflashed VBIOS with ucNumEntries > 8 in the
#   vddc_dependency_on_sclk / mclk / vddci / mvdd dependency tables drives
#   the loops at ci_dpm.c:3621/3634/3646/3657/3667 past the fixed
#   dpm_levels[MAX_REGULAR_DPM_NUMBER=8] arrays, corrupting adjacent
#   ci_power_info fields (golden_dpm_table, voltage_control, SMC offsets).
#
# What WAS validated here: source-trace of the unbounded loops (see
# VERDICT.md) and that fix.diff applies + compiles (see build.log).
echo "DF-1141: runtime trigger requires AMD Sea Islands GPU + malicious VBIOS."
echo "         Not exercisable on this QEMU/KVM guest (no AMD GPU)."
echo "         See VERDICT.md for the source-level confirmation + fix."
exit 0