⬢ DragonFlyBSD Kernel Audit
DF-3954 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-3954",
  "title": "num_levels==0 (VBIOS state with no valid clock entries) -> levels[0xFFFFFFFF] wild read ~48 GiB out in kv_set_valid_clock_range / kv_dpm_get_sclk (radeon kv_dpm)",
  "file": "sys/dev/drm/radeon/kv_dpm.c",
  "severity": "Medium",
  "status": "inconclusive",
  "impact_class": "panic (hardware+VBIOS-gated DoS, wild OOB read)",
  "verdict": {
    "reproduced": false,
    "confidence": "certain (source), runtime-inconclusive on this guest",
    "summary": "kv_parse_power_table :2681-2694 leaves kzalloc'd ps->num_levels == 0 for states with ucNumDPMLevels==0 or all-invalid clockInfoIndex; consumers index levels[num_levels-1] with u32 math (0-1=0xFFFFFFFF, sizeof(kv_pl)=12) -> +0xBFFFFFFF4 (~48 GiB).",
    "harness_result": "child executing verbatim 'ps->levels[ps->num_levels - 1].sclk': SIGSEGV sig=11; displacement print 0xbfffffff4 (48.00 GiB); rc=0"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/kv_dpm.c:1721",
    "sys/dev/drm/radeon/kv_dpm.c:1745",
    "sys/dev/drm/radeon/kv_dpm.c:2886",
    "sys/dev/drm/radeon/kv_dpm.c:2681",
    "sys/dev/drm/radeon/kv_dpm.h:82",
    "sys/dev/drm/radeon/cik.c:9287"
  ],
  "reproduce": {
    "build": "cd findings/poc/DF-3954 && ./build.sh",
    "run": "cd findings/poc/DF-3954 && ./run.sh",
    "expected": "analysis: 'num_levels(u32) = 0 => index = 0xffffffff => displacement = 0xbfffffff4 (48.00 GiB)'; crash: child SIGNALLED sig=11, 'RESULT: WILD READ FAULTS AS PREDICTED'"
  },
  "artifacts": [
    "README.md", "VERDICT.md", "trigger_df3954.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}