⬢ DragonFlyBSD Kernel Audit
DF-4238 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-4238",
  "title": "sdma_v3_0 reads SDMA firmware sub-header fields (ucode_version/ucode_feature_version/ucode_size_bytes at offsets +16/+32/+24) after only the datasize==size_bytes equality check - heap OOB read on a short root-installed firmware blob (DF-1451/1553/1598 family, v3 variant)",
  "verdict": "not_reproduced",
  "impact": "none",
  "confidence": "certain",
  "fix_status": "not_testable",
  "reproduce": {
    "build": "cc -O2 -Wall -o fwcheck fwcheck.c",
    "run": "./fwcheck; echo $?  (139 = SIGSEGV)",
    "expected": "prints amdgpu_ucode_validate(4-byte blob) = 0 (accepted), then dies with SIGSEGV at the first sub-header read (offset +16) hitting the guard page - the exact access order of sdma_v3_0.c:316. Kernel path needs Tonga/Polaris/Fiji/Carrizo/Stoney hardware (absent on the guest)."
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/sdma_v3_0.c:309-317",
    "sys/dev/drm/amd/amdgpu/sdma_v3_0.c:321-326",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:251-260",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:291-300",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:347-351",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.h:26-37",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.h:120-126"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fwcheck.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}