⬢ DragonFlyBSD Kernel Audit
DF-4171 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
{
  "finding_id": "DF-4171",
  "verdict": "reproduced",
  "impact": "leak",
  "severity": "Medium",
  "confidence": "certain",
  "mechanism_correction": "count is uint8_t (hwmgr.h:137-141/183-186): count-1 promotes to int -1, so the access is entries[-1] at table-8, NOT index 0xFFFFFFFF/~16GB; no in-kernel panic -- silent 8-byte heap under-read feeding hard_min_clk/SMU clock params. The finding's defect class (CWE-125 count==0 OOB read, load-time guard passthrough, StablePState/en_umd_pstate triggers) is confirmed verbatim.",
  "reproduce": {
    "build": "cd rig && sh build.sh /usr/src   # 26 verbatim blocks checker-proven byte-identical on the guest; builds rig_base (verbatim slice) + rig_fixed (same slice + this pack's fix.diff)",
    "run": "cd rig && sh run.sh                # 11 modes x {baseline, fixed}; decisive modes: 4171-vce-count0 (StablePState cap), 4171-uvd-count0-en-umd (en_umd_pstate sysfs route), clean-valid",
    "expected": "baseline: both 4171 modes SIGSEGV READ classified '8 bytes BEFORE the start of the 8B table object: NEGATIVE-INDEX UNDERFLOW READ', fault address == the predicted table-8 printed beforehand (entries at +4, record 12B). fixed build: both return rc=-EINVAL with no fault; clean-valid byte-identical; 4169 modes still fault (orthogonal). Three runs byte-identical (run.log, run.2.log, run.3.log)."
  },
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:471",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:473",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1260",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1261",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1856",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1857",
    "sys/dev/drm/amd/powerplay/inc/hwmgr.h:137",
    "sys/dev/drm/amd/powerplay/inc/hwmgr.h:183",
    "sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1119",
    "sys/dev/drm/amd/powerplay/amd_powerplay.c:310"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "env.txt",
    "fix.diff",
    "build.log",
    "run.log",
    "run.2.log",
    "run.3.log",
    "verdict.json",
    "manifest.json",
    "rig/gen_rig.sh",
    "rig/check_verbatim.sh",
    "rig/rig_shims.h",
    "rig/smu8_rig.c",
    "rig/Makefile",
    "rig/build.sh",
    "rig/run.sh",
    "rig/smu8_slice.inc",
    "rig/smu8_slice_fixed.inc",
    "rig/smu8_slice_verbatim.h",
    "rig/rig_fix.diff"
  ]
}