⬢ DragonFlyBSD Kernel Audit
DF-3703 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3703",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain kernel heap overflow: vega10 ODN tables are fixed entries[MAX_REGULAR_DPM_NUMBER=8] (vega10_hwmgr.h:285,290) embedded in the kzallocd struct vega10_hwmgr, but vega10_odn_initial_default_setting (:310-313, :322-323 via smu_get_voltage_dependency_table_ppt_v1 smu_helper.c:684-695), vega10_check_dpm_table_updated (:2432/:2441) and vega10_odn_update_soc_table (:4821-4828) bound their loops by VBIOS dep-table ucNumEntries (<=255, uncapped by the parser) \u2014 up to ~247 x 44-byte attacker-record writes/reads past entries[8] into live driver state and heap neighbors. Reachable at init (:2478-2484, od_enabled) and via root sysfs pp_od_clock_voltage r/c (:4874/:4877). Not reproducible on the virtio-only audit guest (0 AMD PCI devices); cited lines verified in guest /usr/src.",
  "exploit_chain": "crafted VBIOS dep table ucNumEntries>8 + OD enabled -> driver load or root echo r > pp_od_clock_voltage -> entries[8] overflow with attacker-controlled records -> corrupt adjacent vega10_hwmgr state/heap -> crash or privesc primitive on unhardened configs (chain hardware-gated, not demonstrated)",
  "evidence": "VERDICT.md proof chain; run.log (guest-src excerpts :310-323, entries[8] defs, :2432, :4821-4826); trigger_notes.c; fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:310",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:322",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:2432",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4821",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.h:285",
    "sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:684"
  ],
  "poc_changes": "no runnable PoC possible (hardware-gated); documented VBIOS + sysfs triggers; verified cited lines in guest kernel source",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "n/a (data trigger)",
  "run_cmd": "n/a on guest (no AMD hw); guest-src line confirmation in run.log",
  "code_hash": "76061210e43756f2e09a039be3769dcc58388c9cec1004e44cb92bf42c574e5a",
  "notes": "smu7 checklist (a)-adjacent: the odn constructor family. Not covered by known DF-1179..1183.",
  "recommended_fix": "Bound all odn copies/loops by MAX_REGULAR_DPM_NUMBER (min with source count) \u2014 see fix.diff",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ tree; no AMD hw on guest so no patched-kernel validation possible",
  "fix_evidence": "fix.diff; run.log hardware gate"
}