⬢ DragonFlyBSD Kernel Audit
DF-4278 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-4278",
  "title": "R300_ZB_ZPASS_ADDR reloc patch lacks bo-bounds validation (r300.c:1073) -> GPU-side OOB increment-write at attacker-chosen GPU VA",
  "file": "sys/dev/drm/radeon/r300.c",
  "verdict": "untested",
  "impact": "none_demonstrated_gpu_side_oob_write_class",
  "hardware_gated": true,
  "reproduce": {
    "build": "cc -O2 -o zpass_oob zpass_oob.c",
    "run": "./run.sh /dev/dri/card0",
    "expected_vulnerable": "exit 0, 'CS accepted: zpass GPU write target = bo_gpu_offset + 0xF0000000'",
    "expected_patched": "exit 2, RADEON_CS -EINVAL (Invalid argument)"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/r300.c:1073-1082",
    "sys/dev/drm/radeon/r300.c:1274",
    "sys/dev/drm/radeon/r100.c:1375",
    "sys/dev/drm/radeon/r100.c:1778",
    "sys/dev/drm/radeon/r100.c:2264"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "zpass_oob.c", "build.sh", "run.sh",
    "fix.diff", "env.txt", "manifest.json", "verdict.json"
  ],
  "code_hash": "a7b0dc039dea1e050766711237d67094f93a7489c6ce19c679d782dfe109a321"
}