⬢ DragonFlyBSD Kernel Audit
DF-3705 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
{
  "finding_id": "DF-3705",
  "title": "vega10 SMC populate loops (CksEnable/CksVidOffset, StaticVoltageOffsetVid, UvdDpmVoltageIndex, SocVid) write 8-entry PPTable arrays with unbounded dep-table counts",
  "verdict": "inconclusive",
  "impact": "source-certain heap OOB writes into PPTable/vega10_hwmgr state; not demonstrable on guest",
  "reproduce": {
    "build": "n/a — VBIOS data trigger",
    "run": "crafted-VBIOS Vega10 (dep ucNumEntries>8 + matching feature masks) at driver load",
    "expected": "bytes written past CksEnable[8]/StaticVoltageOffsetVid[8]/UvdDpmVoltageIndex[8]/SocVid[8]"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:2060",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:2143",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:2030",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1700",
    "sys/dev/drm/amd/powerplay/inc/smu9_driver_if.h:229"
  ],
  "artifacts": ["README.md","VERDICT.md","trigger_notes.c","build.sh","run.sh","run.log","env.txt","fix.diff","manifest.json","verdict.json"]
}