⬢ DragonFlyBSD Kernel Audit
DF-3644 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-3644",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain heap buffer overflow, radeon/ci twin of DF-3585/DF-3614 (si) and DF-3619 (amdgpu ci). ci_construct_voltage_tables() (ci_dpm.c:2179-2182, 2197-2200, 2215-2218) calls ci_get_svi2_voltage_table() when the VBIOS programs CISLANDS_VOLTAGE_CONTROL_BY_SVID2 (the common regulator style on Sea Islands). That helper sets voltage_table->count = voltage_dependency_table->count (ci_dpm.c:2159) and copies that many struct atom_voltage_table_entry (8 bytes each) into entries[] (ci_dpm.c:2160-2163). The count comes raw from the VBIOS u8 ucNumEntries via r600_parse_clk_voltage_dep_table (r600_dpm.c:821-844, no cap), so up to 255; the destination array is entries[MAX_VOLTAGE_ENTRIES=32] (radeon_mode.h:671-685) embedded in struct ci_power_info (ci_dpm.h:228-230). The si_trim_voltage_table_to_fit_state_table() calls at ci_dpm.c:2187-2189/2205-2207/2223-2225 cap the count to 8/4/4 only AFTER the copy - far too late. Worst case is (255-32)*8 = 1784 bytes of overwrite past entries[32], running over vddci_voltage_table, mvdd_voltage_table and ~1KB past the end of the kzallocd struct ci_power_info. Data is semi-attacker-chosen: a u16 voltage value at every 8-byte stride plus zeroed smio_low. On-guest userland harness with the exact kernel types proved the geometry (200-entry table -> 1344-byte OOB write, adjacent canary clobbered). Runtime reproduction on the kernel path is impossible on this virtio-only guest (no AMD GPU), hence inconclusive/not reproduced at kernel level. Same root cause family as pass-1 DF-1150 but a DIFFERENT array (atom_voltage_table.entries vs ci dpm_levels) and different function - not a re-report.",
  "exploit_chain": "Provision a crafted VBIOS on a Sea Islands card (BONAIRE/HAWAII; device IDs routed to this file via radeon_family) whose VoltageObjectInfo marks VDDC as SVID2 and whose vddc/vddci/mvdd dependency tables carry >32 entries; boot/login triggers ci_dpm_init -> ci_construct_voltage_tables -> the overflow. Characterized primitive: attacker-chosen u16 at each 8-byte slot over ~1.8KB past a large kmalloc - enough to corrupt the adjacent slab objects fields (e.g. function-pointer low halves / refcounts) in the classic slab-groom -> victim-object -> pivot chain; on this audit target the escalation chain cannot be exercised because the guest has no CI GPU (hardware-gated). Panic-level impact is certain from source; uid=0 route plausible but untestable here.",
  "evidence": "VERDICT.md (full source trace); harness.c + run.log/run.2.log section [A] (OOB write of 1344 bytes past entries[32]; canary clobbered: YES); env.txt (guest has no AMD GPU: pciconf 0x1002 count=0, /dev/dri absent, no drm kld); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/radeon/ci_dpm.c:2147",
    "sys/dev/drm/radeon/ci_dpm.c:2159",
    "sys/dev/drm/radeon/ci_dpm.c:2160",
    "sys/dev/drm/radeon/ci_dpm.c:2187",
    "sys/dev/drm/radeon/ci_dpm.c:2205",
    "sys/dev/drm/radeon/ci_dpm.c:2223",
    "sys/dev/drm/radeon/r600_dpm.c:821",
    "sys/dev/drm/radeon/r600_dpm.c:841",
    "sys/dev/drm/radeon/radeon_mode.h:671",
    "sys/dev/drm/radeon/radeon_mode.h:684"
  ],
  "poc_changes": "n/a \u2014 no seeded PoC for pass-2; harness written fresh (models the exact kernel types; divisors made volatile so -O2 cannot fold the #DE)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 45,
  "guest_dirty": 1,
  "build_cmd": "cc -O2 -Wall -o harness harness.c",
  "run_cmd": "./harness",
  "code_hash": "af83fc943c96cc840bab14bf99787f6e37c43ec42b624d998c2461cc2dad15f2",
  "notes": "pass 2 radeon/ci_dpm.c; twins: DF-3585/DF-3614/DF-3619. Guest virtio-only per task; harness scratch files under /root removed.",
  "recommended_fix": "Reject SVI2 dependency tables with count > MAX_VOLTAGE_ENTRIES in ci_get_svi2_voltage_table before the copy loop.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation would require a CI-class GPU with a crafted VBIOS (baseline panic/corruption) and a single-fix kernel build; the audit guest is virtio-only, so the fix is source-reviewed only (fix.diff).",
  "fix_evidence": "fix.diff in this pack; not applied to sys/ (read-only audit target)."
}