⬢ DragonFlyBSD Kernel Audit
DF-3942 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-3942",
  "title": "bios_parser.c: five spread-spectrum parsers dereference unchecked GET_IMAGE() results -> NULL-page panic at amdgpu/dc attach with crafted VBIOS",
  "verdict": "inconclusive",
  "impact": "kernel panic (DoS, crafted-VBIOS-gated)",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O2 -Wall -o /tmp/bios_ss_null_deref_replica bios_ss_null_deref_replica.c",
    "run": "/tmp/bios_ss_null_deref_replica",
    "expected": "Logic replica prints the kernel decision trace (4-byte rev probe ok, struct GET_IMAGE NULL) then SIGSEGVs on the replicated deref (rc=139). In-kernel equivalent: panic at bios_parser.c:1046."
  },
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:1041",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:1046",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:1114",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:1140",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:1645",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:1671",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:1723",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:1726",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:1759",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:1761",
    "sys/dev/drm/amd/display/dc/bios/bios_parser_helper.c:36"
  ],
  "artifacts": [
    "bios_ss_null_deref_replica.c", "build.sh", "run.sh", "build.log", "run.log",
    "fix.diff", "fix_build.log", "VERDICT.md", "README.md",
    "verdict.json", "manifest.json"
  ]
}