⬢ DragonFlyBSD Kernel Audit
DF-3745 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3745",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "radeon_get_atom_connector_info_from_object_table() (the DCE4+ connector path) dereferences a web of unvalidated BIOS values: (1) table bases from u16 offsets usStateArrayOffset/usClockInfoArrayOffset/usNonClockInfoArrayOffset/usDisplayPathTableOffset/usConnectorObjectTableOffset/usEncoderObjectTableOffset/usRouterObjectTableOffset (:537-548); (2) the display-path walk accumulates attacker u16 usSize values (:551-557) \u2014 two 0x8000 sizes put the record pointer 64 KiB out; (3) per-object usRecordOffset/usSrcDstTableOffset u16 offsets dereferenced immediately (:654-656, :685-698); (4) router src/dst: enum_id runs to *num_dst_objs (u8<=255) then indexes ucMuxState[enum_id] though ucMuxState is UCHAR[2] (atombios.h:4380-4395) \u2014 up to 253 B OOB (:732/:740); (5) record chains stepped by ucRecordSize with no image-end bound (:660-672, :772-803). All of this reads past the rdev->bios heap image at boot/attach (values feed connector config; distinct surface from the power-table indices of DF-1200). Harness on guest demonstrates each sub-case. Kernel path unreachable on this guest.",
  "exploit_chain": "crafted Object_Header table -> OOB pointer arithmetic at radeon_modeset_init -> reads of adjacent kernel heap -> crash (values also propagate into connector/encoder setup)",
  "evidence": "harness_objtable.c + build.log + run.log; VERDICT.md; kernel refs sys/dev/drm/radeon/radeon_atombios.c:536-548",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_atombios.c:536-548",
    "sys/dev/drm/radeon/radeon_atombios.c:551-557",
    "sys/dev/drm/radeon/radeon_atombios.c:654-656",
    "sys/dev/drm/radeon/radeon_atombios.c:682-698",
    "sys/dev/drm/radeon/radeon_atombios.c:703-740",
    "sys/dev/drm/radeon/radeon_atombios.c:772-803",
    "sys/dev/drm/radeon/atombios.h:4380-4395"
  ],
  "poc_changes": "harness written from scratch (no seed PoC): verbatim kernel arithmetic replica with canary-guarded destination model, built and executed on the DragonFly guest (cc 8.3); fixed nested-comment, stddef/stdint includes and volatile divisors during bring-up",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 6,
  "guest_dirty": 0,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh (after ./build.sh)",
  "code_hash": "9465d6ae79ceabe9b5478eec57f8c6848dfd4c892fcb9b1ebfdcbe64f9ec8218",
  "notes": "Guest has NO AMD/radeon GPU (virtio-only); /boot/kernel/radeon.ko exists (code shipped in the default install) but cannot attach, so the kernel code path is unreachable at runtime on this guest. Evidence is source-level certainty (path:line traced) plus a verbatim-arithmetic userland harness compiled and executed on the guest (build.log/run.log).",
  "recommended_fix": "validate every BIOS offset/size against the image length before use (needs the bios_size plumbing of DF-3744)",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored after source-level verification; cannot be validated on this guest (no AMD GPU; radeon.ko cannot attach). Compiling the module or booting a patched kernel would not exercise the path without hardware.",
  "fix_evidence": "fix.diff (unified, against read-only sys/ tree; never applied)"
}