DragonFlyBSD Kernel Audit
DF-1179 / run.log
← back to finding ↓ download raw
BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  8760 Jul 17 06:46 harness
----- RUN -----
=== DF-1179: vega10 DPM table OOB on dpm_levels[8] ===
  soc_table (count=6): count=6 (cap=8) (ok)
  gfx_table.count after benign run = 0 (must be 0)

[*] crafted VBIOS: dep_table->count = 20 (all ascending)
  soc_table (count=20): count=20 (cap=8) >>> OVERFLOW
[!] CONFIRMED OOB: gfx_table (the NEXT vega10_single_dpm_table in the backend) was corrupted by soc_table overflow.
    gfx_table.count=500  gfx_table.dpm_levels[0].value=0x1

[*] worst case: dep_table->count=255 -> dpm_table->count=255 (247 entries past dpm_levels[8])

[+] DF-1179 OOB CONFIRMED: dep_table->count (u8 from VBIOS) drives writes past dpm_levels[8].
RUN_EXIT=0