⬢ DragonFlyBSD Kernel Audit
DF-4183 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
{
  "finding_id": "DF-4183",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain missing size validation, amdgpu twin of DF-4181: amdgpu_display_user_framebuffer_create (amdgpu_display.c:523) / amdgpu_display_framebuffer_init (amdgpu_display.c:506) never compare the requested scanout image size against the backing GEM object, and this one create function serves BOTH display stacks (.fb_create registered in amdgpu_mode_funcs at amdgpu_display.c:561 for legacy DCE8/10/11 and in amdgpu_dm.c:945 for DC). The DRM cores framebuffer_check (drm_framebuffer.c:165-275) only enforces format validity, pitch>=width*cpp (:211) and height*pitch+offsets<=UINT_MAX (:208) and never sees the object (fb_create dispatched at :310). A 16 KiB BO therefore backs a 1920x1080 XRGB8888 fb (8,294,400 B); every scanout path then pins and programs without re-checking - legacy dce_v11_0_crtc_do_set_base pins (dce_v11_0.c:1904) and programs GRPH_X_END/Y_END=fb->width/height + GRPH_PITCH (:2073-2077) + VIEWPORT_SIZE (:2088-2091), same shape dce_v10_0.c:1862 / dce_v8_0.c:1791; DC dm_plane_helper_prepare_fb pins (amdgpu_dm.c:3518); the flip path pins the new BO (amdgpu_display.c:191) - so the display engine fetches pitch*height bytes from the undersized object and discloses adjacent VRAM contents on the physical display. Not exercisable on this guest: no AMD/ATI PCI device, no /dev/dri (run.log, env.txt); hardware-gated like DF-4181.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (core-vs-driver responsibility trace incl. DC path); amdgpu_fb_oob.c (CREATE_DUMB 64x64 + ADDFB2 1920x1080; success criterion: ADDFB2==0 bug vs -EINVAL fixed); build.log + run.log (build OK, open /dev/dri/card0 ENOENT, exit 2); env.txt (no vendor-0x1002 PCI, no drm klds); fix.diff + fix_build.log (amdgpu.ko built standalone -Werror -DKLD_MODULE with fix, rc=0)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_display.c:523",
    "sys/dev/drm/amd/amdgpu/amdgpu_display.c:506",
    "sys/dev/drm/amd/amdgpu/amdgpu_display.c:561",
    "sys/dev/drm/amd/amdgpu/amdgpu_display.c:191",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:945",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:3518",
    "sys/dev/drm/amd/amdgpu/dce_v11_0.c:1904",
    "sys/dev/drm/amd/amdgpu/dce_v11_0.c:2073",
    "sys/dev/drm/amd/amdgpu/dce_v11_0.c:2076",
    "sys/dev/drm/amd/amdgpu/dce_v10_0.c:1862",
    "sys/dev/drm/amd/amdgpu/dce_v8_0.c:1791",
    "sys/dev/drm/drm_framebuffer.c:165",
    "sys/dev/drm/drm_framebuffer.c:208",
    "sys/dev/drm/drm_framebuffer.c:211",
    "sys/dev/drm/drm_framebuffer.c:310"
  ],
  "poc_changes": "Adapted from DF-4181s rfb_oob.c: same raw-ioctl trigger (no libdrm), amdgpu path citations and the amdgpu-specific fb_create registration sites added; UAPI identical for amdgpu.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 420,
  "guest_dirty": 1,
  "build_cmd": "cc -O -Wall -o amdgpu_fb_oob amdgpu_fb_oob.c",
  "run_cmd": "./amdgpu_fb_oob /dev/dri/card0",
  "code_hash": "490974d3bc4dc04d41bf1075cf247d04e5b4eb8504f7dcfa03b95326d3598392",
  "notes": "Unprivileged-reachable on any amdgpu KMS desktop (DRM master via logind). Impact ceiling: visual/physical-display disclosure of adjacent VRAM; no kernel memory involved, no write primitive. Unlike radeon (DF-4181), the amdgpu gap covers the DC stack too (amdgpu_dm.c:945 reuses the same create fn). Pre-drm_gem_fb vintage; upstream closed it by moving to drm_gem_fb_creates per-plane checks.",
  "recommended_fix": "Per-plane check in amdgpu_display_framebuffer_init: offsets[i] + pitches[i]*DIV_ROUND_UP(height, vsub) must be <= amdgpu_bo_size(obj), else -EINVAL (mirrors DF-4181 radeon fix).",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Compile-validated only: fix.diff applied cleanly to the guest /usr/src (md5 21c72601... -> f68f1ac9...) and amdgpu.ko built standalone with -Werror -DKLD_MODULE (make -j6 in sys/dev/drm/amd/amdgpu: rc=0 in 28.7s, zero error/warning lines, amdgpu.ko 3.7 MB linked with the patched amdgpu_display.o; fix_build.log:90). Source reverted to pristine after the build. Behavioral test impossible on this guest (no AMD GPU).",
  "fix_evidence": "fix_build.log line 90 (amdgpu_display.c compile with -Werror -DKLD_MODULE), --- amdgpu.ko --- link line, zero error:/warning: matches; md5 sequence 21c726011a45df09bacd7632af9f2e81 -> f68f1ac92d89aaeb3985c00c4d684eec -> 21c726011a45df09bacd7632af9f2e81 in the run transcript."
}