⬢ DragonFlyBSD Kernel Audit
DF-3598 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-3598",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "gfx_v8_0.c:1082 assigns err = amdgpu_ucode_validate(adev->gfx.rlc_fw) and never checks it (next err assignment is request_firmware at :1129), while pfp/me/ce/mec/mec2 all have if (err) goto out (:1020, :1040, :1061, :1141, :1162). A wrong-sized RLC firmware therefore proceeds to rlc_firmware_header_v2_0 field parsing (:1083-1104) and the register-list kmalloc/copy loops (:1106-1125); a file shorter than the 72-byte header makes those reads OOB, and the skipped datasize==size_bytes gate lets garbage sizes/offsets reach the DF-1133 heap-OOB loops and fw_size accounting. Kernel run impossible on the virtio-only guest (no AMD device, no amdgpu module); source-level proof via run.sh output (1082 UNGUARDED vs 5x GUARDED).",
  "exploit_chain": "replace amdgpufw_<asic>_rlc with truncated/corrupt image -> init_microcode proceeds despite validate failure -> OOB header reads / garbage list sizes -> composes with DF-1133 heap OOB write. Not executed (no AMD HW).",
  "evidence": "run.log (awk proof: 1082 UNGUARDED, others GUARDED); VERDICT.md; fix.diff (2-line symmetric guard)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1082",
    "sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1083",
    "sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1106",
    "sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1129",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.h:79"
  ],
  "poc_changes": "authored fresh (pass 2); no seed existed",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "(none - source assertion)",
  "run_cmd": "./run.sh",
  "code_hash": "",
  "notes": "Same DF-3573/DF-3591 size-gate-symmetry class; the gate itself is weak (DF-1946) but is the only local check before DF-1133s loops.",
  "recommended_fix": "Add if (err) goto out; after gfx_v8_0.c:1082, symmetric with the pfp/me/ce/mec/mec2 loaders.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the missing guard, line-matched to the current tree; kernel build/run not possible on virtio-only guest (amdgpu module absent).",
  "fix_evidence": "findings/poc/DF-3598/fix.diff"
}