⬢ DragonFlyBSD Kernel Audit
DF-3705 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3705",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain heap OOB writes at SMC-table population: vega10_populate_clock_stretcher_table (:2060-2064 CksEnable[8]/CksVidOffset[8]), vega10_populate_avfs_parameters (:2143-2145 StaticVoltageOffsetVid[8]), vega10_populate_smc_uvd_levels (:2030-2045 UvdDpmVoltageIndex[8] + dpm_levels[8] OOB reads) and vega10_populate_vddc_soc_levels (:1700-1708 SocVid[8]) all loop on VBIOS dep-table ucNumEntries (<=255, uncapped) while the SMC arrays are 8 (smu9_driver_if.h:167,187,229-230,294); the guarded twin at :1850-1852 shows the missing check. Up to ~247 attacker-influenced bytes per sink written into the PPTable upload block and adjacent vega10_hwmgr heap state at driver load. Not reproducible on the virtio-only audit guest (0 AMD PCI devices); lines verified in guest /usr/src.",
  "exploit_chain": "crafted VBIOS (GFXCLK dep ucNumEntries>8 + clock-stretcher/AVFS/MM tables) -> driver load -> populate loops write past 8-entry SMC arrays -> heap corruption in struct vega10_hwmgr -> crash/privesc primitive on unhardened configs (hardware-gated, not demonstrated)",
  "evidence": "VERDICT.md proof chain; run.log (guest-src excerpts :2060-2063, :2143-2145, :2030-2036, :1700-1704, array defs); trigger_notes.c; fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:2060",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:2143",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:2030",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1700",
    "sys/dev/drm/amd/powerplay/inc/smu9_driver_if.h:229",
    "sys/dev/drm/amd/powerplay/inc/smu9_driver_if.h:294"
  ],
  "poc_changes": "no runnable PoC possible (hardware-gated); documented VBIOS recipe per sink",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "n/a (data trigger)",
  "run_cmd": "n/a on guest (no AMD hw)",
  "code_hash": "f50829a7332177192f80e2edc1456dcd180c330b5201119a2c73d6c8a4e26a6f",
  "notes": "smu7 checklist item (h). Not covered by known DF-1179..1183 (those are dpm_levels[8], entries[32], vddInd, state-record indices, soc_index_for_max_uclk).",
  "recommended_fix": "Add count<=ARRAY asserts before each loop mirroring :1850-1852 (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ tree; no AMD hw on guest so no patched-kernel validation possible",
  "fix_evidence": "fix.diff; run.log hardware gate"
}