DragonFlyBSD Kernel Audit
DF-1307 / run.log
← back to finding ↓ download raw
BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  9552 Jul 20 09:16 harness
DF-1307 kv_parse_power_table VCE clk_idx OOB read harness
sizeof(ClockInfoArray) overhead = 3 (clockInfo is UCHAR flex[1])
ClockInfoArray @ 0x8004a0fee (clockInfo[0] @ 0x8004a0ff0), ucNumEntries=2, ucEntrySize=255
VBIOS VCE clk_idx = 63  (NO check vs ucNumEntries=2)
access byte offset = 63 * 255 = 16065  (past the 2 valid entries)
FAULT (signal 11): OOB read at clockInfo[16065] off the bios buffer
  -> in-kernel equivalent: heap OOB read up to 16065 bytes past clockInfo[0]
RESULT: OOB read CONFIRMED at kv_dpm.c:2707 (VCE clk_idx byte-index with NO bounds check vs ucNumEntries)
RUN_EXIT=0
RUN_EXIT=0