⬢ DragonFlyBSD Kernel Audit
DF-3698 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-3698",
  "title": "gfx_v9_0 cu_info walkers index bitmap[4][4]/ao_cu_bitmap[4][4] with unclamped max_shader_engines/max_sh_per_se from gpu_info firmware / VBIOS -> heap OOB write+read",
  "verdict": "not_reproduced",
  "impact": "none",
  "impact_on_hardware": "linear kernel heap OOB write past adev->gfx.cu_info inside amdgpu_device (panic, potential exploitation) + OOB read",
  "threat_model": "attacker-controlled amdgpufw_<asic>_gpu_info firmware file (root path / supply chain) or crafted VBIOS gfx_info table (VEGA20)",
  "reproduce": {
    "build": "cc -O2 -o fwgen_gi fwgen_craft_gpuinfo.c",
    "run": "./fwgen_gi",
    "expected": "generates amdgpufw_raven_gpu_info.evil (gc_num_se=64); on AMD hardware installed as the gpu_info fw it makes gfx_v9_0_get_cu_info write bitmap[0..63][0..3] over a [4][4] array -> heap corruption/panic"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/gfx_v9_0.c:4990",
    "sys/dev/drm/amd/amdgpu/gfx_v9_0.c:5000",
    "sys/dev/drm/amd/amdgpu/gfx_v9_0.c:5013",
    "sys/dev/drm/amd/amdgpu/gfx_v9_0.c:937",
    "sys/dev/drm/amd/amdgpu/gfx_v9_0.c:945",
    "sys/dev/drm/amd/amdgpu/gfx_v9_0.c:958",
    "sys/dev/drm/amd/amdgpu/gfx_v9_0.c:1422",
    "sys/dev/drm/amd/amdgpu/amdgpu_gfx.h:197",
    "sys/dev/drm/amd/amdgpu/amdgpu_device.c:1379",
    "sys/dev/drm/amd/amdgpu/amdgpu_atomfirmware.c:349"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fwgen_craft_gpuinfo.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}