⬢ DragonFlyBSD Kernel Audit
DF-3600 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
{
  "finding_id": "DF-3600",
  "title": "sq_edc_source_names[] indexed by unbounded 3-bit SQ_EDC_INFO.SOURCE field: OOB rodata read handed to %s (panic/minor leak)",
  "verdict": "inconclusive",
  "impact": "panic inside SQ error-reporting path (or dmesg disclosure of adjacent rodata) when HW latches reserved encoding 7",
  "reproduce": {
    "build": "(none; source assertion)",
    "run": "./run.sh",
    "expected": "7-entry array vs 3-bit field (0x1c0>>6 => 0..7) and the unguarded names[sq_edc_source] at :6831"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/gfx_v8_0.c:710",
    "sys/dev/drm/amd/amdgpu/gfx_v8_0.c:6811",
    "sys/dev/drm/amd/amdgpu/gfx_v8_0.c:6831",
    "sys/dev/drm/amd/include/asic_reg/gca/gfx_8_0_sh_mask.h:14083"
  ],
  "artifacts": ["run.sh", "run.log", "README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"]
}