DragonFlyBSD Kernel Audit
DF-1183 / run.log
← back to finding ↓ download raw
== buggy ==
vega10_get_soc_index_for_max_uclk hardcoded entries[3] but count=2 => OOB read (CWE-125)
Returned index (garbage, from past-allocation bytes): 1

== fixed ==
Fixed version returns -1 (validated count < 4)

=== DF-1183 logic-level result ===
Hardcoded entries[3] without count check on a table allocated
for ucNumEntries slots. Malicious VBIOS with ucNumEntries<4
reads kernel heap. Path runs only when amdgpu powerplay is
attached to a real Vega10 GPU - no AMD HW on this guest.
RUN_EXIT=0