⬢ DragonFlyBSD Kernel Audit
DF-1269 / trigger.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
/*
 * DF-1269 trigger (latent / not live-reproducible on audit guest)
 *
 * kv_parse_power_table @ kv_dpm.c uses VBIOS-supplied indices without
 * bounds checks against ucNumEntries:
 *
 *   :2745  non_clock_array_index = power_state->v2.nonClockInfoIndex;  (u8)
 *   :2746  non_clock_info = &non_clock_info_array->nonClockInfo[non_clock_array_index];
 *          ^^^ no check non_clock_array_index < non_clock_info_array->ucNumEntries
 *   :2780  clock_array_index = adev->pm.dpm.vce_states[i].clk_idx;     (0..63)
 *   :2782  clock_info = &clock_info_array->clockInfo[clock_array_index * ucEntrySize];
 *          ^^^ no check vs ucNumEntries (the sibling at :2758 DOES check)
 *
 * A crafted VBIOS => OOB read from the BIOS mapping at kv power-table
 * parse time => panic or leak into sysfs-visible rps fields.
 *
 * Reachability REQUIRES an AMD APU/GPU (amdgpu kv path). No such HW on
 * the audit guest => not live-reproducible. See VERDICT.md.
 */

int main(void) { return 0; }