DF-4150 / verdict.json
{ "finding_id": "DF-4150", "status": "untested", "attempts": 0, "reproduced": 0, "confidence": "likely", "impact": "NULL deref of adev->pdev->bus->self in cik_pcie_gen3_enable/cik_program_aspm on root-bus CIK GPUs (upstream pci_is_root_bus guard #if 0d out in the DFly port). Boot/attach DoS on server platforms / VM GPU passthrough topologies.", "verdict": "source-verified; hardware-gated (no CIK asic on audit guest)", "exploit_chain": [], "evidence": "cik.c:1379 root = pdev->bus->self used at :1417/:1630; the #if 0 guard sites 1385-1388/1549-1552 have no replacement", "kernel_refs": [ "sys/dev/drm/amd/amdgpu/cik.c:1379", "sys/dev/drm/amd/amdgpu/cik.c:1417", "sys/dev/drm/amd/amdgpu/cik.c:1630" ], "guest_uname": "", "code_hash": "", "artifact_dir": "findings/poc/DF-4150/", "fix_status": "not_testable", "fix_baseline_reproduced": 0, "fix_patched_reproduced": 0, "fix_verdict": "replace the disabled pci_is_root_bus guards with explicit if (adev->pdev->bus->self == NULL) return; in both functions", "fix_evidence": "source-only" } |