DragonFlyBSD Kernel Audit
DF-1402 / run.log
← back to finding ↓ download raw
### build ###
built trinity_vce_oob
### run ###
DF-1402 trinity VCE clk_idx OOB-read demonstration
clockInfoArray.ucNumEntries = 1, ucEntrySize = 16
  level 0: clk_idx=63 -> byte offset [63*16=1008] OOB -> sclk=0xdddddd
  level 1: clk_idx=63 -> byte offset [63*16=1008] OOB -> sclk=0xdddddd
  level 2: clk_idx=63 -> byte offset [63*16=1008] OOB -> sclk=0xdddddd
  level 3: clk_idx=63 -> byte offset [63*16=1008] OOB -> sclk=0xdddddd
guard present? : NO (clock path at :1789 checks, this VCE loop does not)

OOB READ CONFIRMED: clk_idx=63 vs ucNumEntries=1 reads ~1008 bytes OOB per level (idx*ucEntrySize).
READ-ONLY primitive -> no escalation; impact = wrong VCE engine clock / OOB info read (DoS via bogus clock programming on crafted VBIOS).
### exit=0 ###