⬢ DragonFlyBSD Kernel Audit
DF-3945 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-3945",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "CVE-2019-14615 (Intel PSIRT-TA-201910-001) is carried: the Gen9 indirect-context workaround batch gen9_init_indirectctx_bb (intel_lrc.c:1553-1627) lacks the unconditional WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl PIPE_CONTROL that upstream bc8a76a152c5 / stable dd4f3b3508f6 insert between the coherent-L3 flush WA (:1581) and emit_lri (:1583); only a KBL-A0-stepping-gated variant exists (:1587). Gen8 has the cleardown (:1509-1517), matching the upstream commit text. The tree carries all other intel_lrc.c stable fixes of its vintage (Nov/Dec 2018 execlists write-serialisation mb() fixes present at :455), isolating this as the carried gap. Impact on real Gen9 hardware (SKL/KBL/BXT/GLK/CFL): EU residual state is not cleared on context switch -> cross-context/cross-user info disclosure. Guest has no Intel GPU, so not reproduced at runtime.",
  "exploit_chain": "on Gen9 HW: victim context computes on secrets (e.g. crypto via EGL/VA-API) -> attackers unprivileged context submits a shader reading uninitialized EU registers before first write -> residual victim data disclosed",
  "evidence": "run.log (guest-side gen9/gen8 BB dumps showing missing cleardown; FLUSH_L3 only at :1512 gen8 and :1589 KBL-A0), VERDICT.md (upstream 4.19.y history walk + patch-context match), fix.diff (adapted upstream fix, git-apply-clean)",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_lrc.c:1581",
    "sys/dev/drm/i915/intel_lrc.c:1583",
    "sys/dev/drm/i915/intel_lrc.c:1587",
    "sys/dev/drm/i915/intel_lrc.c:1509"
  ],
  "poc_changes": "no seed; source-presence checker vs upstream patch dd4f3b3508f6",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "(none \u2014 static check)",
  "run_cmd": "./check_cve_carriage.sh /usr/src/sys/dev/drm/i915/intel_lrc.c",
  "code_hash": "a915ee8fbd96bd222686c5a8cdb2217e4bd5508cd4a3a909ed2913045ab6445c",
  "notes": "cve_match=equivalent to CVE-2019-14615 (upstream bc8a76a152c5, stable dd4f3b3508f6); real-hardware impact class = leak",
  "recommended_fix": "Backport the upstream gen9 cleardown pipe control (fix.diff) into gen9_init_indirectctx_bb",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "no Gen9 GPU on the audit guest; fix.diff = upstream CVE fix adapted to i915_scratch_offset(), applies clean to sys/",
  "fix_evidence": "fix.diff; git apply --check clean"
}