⬢ DragonFlyBSD Kernel Audit
DF-3698 / run.log
← back to finding ↓ download raw
crafted amdgpufw_raven_gpu_info.evil: 96 bytes
  gc_num_se=64 gc_num_sh_per_se=4 -> cu_info->bitmap[64][4]
  vs. fixed array dimensions [4][4] (amdgpu_gfx.h:197-198)
  -> gfx_v9_0_get_cu_info() writes up to 64*4*4 = 1024 bytes
     past bitmap[0][0] of a [4][4]=64-byte array = heap OOB write
-rw-r--r--  1 root  wheel  96 Sep 15 18:17 amdgpufw_raven_gpu_info.evil
MD5 (fwgen_gi.c) = 4097a78162dc4bc1aa5740ffa50b1a54