⬢ DragonFlyBSD Kernel Audit
DF-4220 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-4220",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Reproduced on the audit guest as module code: build_evenly_distributed_points() (color_gamma.c:1066-1107) with numberof_points==0 writes 3 extra points past a kcalloc(n+3)=3-entry object (24-byte heap OOB write at obj+72, SIGSEGV on a guard page, 5/5 runs at -O2/-O0) and with numberof_points==1 computes dc_fixpt_from_fraction(0,0) => divide-by-zero (SIGFPE; kernel #DE panic). impact=none because no kernel path is reachable in this tree: the only in-tree caller validates num_entries in {256,4096} (amdgpu_dm_color.c:148-157,270-277) and the AMD display tree is standalone module source not wired into sys/conf/files. Latent exported-API hazard: a future caller trusting a user-controlled LUT size turns it into heap overflow / panic.",
  "exploit_chain": "",
  "evidence": "trigger/run.log: FAULT: SIGFPE at address 0x0 (T2, n==1) and FAULT: SIGSEGV at address 0x800474000 (T1, n==0; fault address == obj end = the p[3] extra-point write); T3 control PASS with extras exactly 2/3,1/2,2/5 proving faithful arithmetic; trigger/fix_run.log: with the one-line guard from fix.diff both fault tests RETURN WITHOUT FAULT. Verbatim copies sha256-matched in env.txt.",
  "kernel_refs": [
    "sys/dev/drm/amd/display/modules/color/color_gamma.c:1066-1107",
    "sys/dev/drm/amd/display/modules/color/color_gamma.c:1081-1082",
    "sys/dev/drm/amd/display/modules/color/color_gamma.c:1092-1106",
    "sys/dev/drm/amd/display/modules/color/color_gamma.c:1382-1384",
    "sys/dev/drm/amd/display/modules/color/color_gamma.c:1593-1595",
    "sys/dev/drm/amd/display/modules/color/color_gamma.c:1407-1410",
    "sys/dev/drm/amd/display/modules/color/color_gamma.c:1617-1620",
    "sys/dev/drm/amd/display/dc/basics/fixpt31_32.c:43-55",
    "sys/dev/drm/amd/display/dc/os_types.h:72-77",
    "sys/dev/drm/include/linux/math64.h:75-80",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c:148-157"
  ],
  "poc_changes": "self-authored harness; stub dm_services.h provides release ASSERT semantics (no-op, os_types.h:76) and the exact div64_u64_rem from math64.h so a zero divisor raises SIGFPE exactly as the kernel takes #DE",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "cd findings/poc/DF-4220/trigger && cc -O2 -Wall -o harness color_gamma_harness.c fixpt31_32.c",
  "run_cmd": "cd findings/poc/DF-4220/trigger && ./run.sh",
  "code_hash": "ec8010a17f8df9913bd14e8d58dd7376fd198fb4352b4d3428dfc96f75dd2e22",
  "notes": "First build iteration failed on the stub (missing div64_s64, typedef mismatch); fixed and re-run. Faults reproduce at -O0 and -O2, 5/5 runs. color_gamma_harness_fixed.c + fix_run.log contain the fix-logic validation. Guest left clean (only /tmp/df4220 scratch).",
  "recommended_fix": "Validate ramp->num_entries >= 2 in mod_color_calculate_regamma_params/mod_color_calculate_degamma_params and replace the ineffective ASSERT with a hard if (numberof_points < 2) return; in build_evenly_distributed_points",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix logic validated in the same on-guest harness (color_gamma_harness_fixed.c): baseline faults (SIGFPE + guard-page SIGSEGV) are gone with the one-line guard, control case unchanged. Kernel-level rebuild not applicable: color_gamma.c is standalone module source not compiled into any kernel config in this tree.",
  "fix_evidence": "trigger/fix_run.log: T2: RETURNED WITHOUT FAULT, T1: RETURNED WITHOUT FAULT, T3 PASS \u2014 versus trigger/run.log faults on the unpatched variant."
}