⬢ DragonFlyBSD Kernel Audit
DF-3656 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
{
  "finding_id": "DF-3656",
  "verdict": "inconclusive",
  "impact": "none",
  "reproduce": {
    "build": "n/a — source-level ownership trace; no runnable model for an OOM-timing kernel UAF",
    "run": "n/a — requires amdgpu hardware plus an induced allocation/debugfs failure during DM init (fault injection)",
    "expected": "on a fault-injected amdgpu init failure after registration, drm_mode_config_cleanup() (invoked by the driver's own error unwind) operates on kfree'd connector/encoder/plane objects; DDC transactions dereference the freed i2c adapter"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4080",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4131",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:1937",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:1947",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4164"
  ],
  "artifacts": [
    "env.txt", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json", "README.md"
  ]
}