⬢ DragonFlyBSD Kernel Audit
DF-4312 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-4312",
  "finding": "dcn10_link_encoder_create indexes 4-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source values (-1..9 / -1..7 / 0..6) -> OOB kernel reads used as MMIO register bases",
  "file": "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c",
  "lines": [744, 746],
  "verdict": "inconclusive",
  "impact": "none (on this guest: no AMD GPU; potential: wild MMIO from crafted VBIOS on Raven-class APU)",
  "confidence": "certain (missing check), impact hardware-gated",
  "reproduce": {
    "build": "n/a (kernel driver; requires DCN1 ASIC + crafted VBIOS object tables)",
    "run": "n/a on audit guest - see README.md for the real-hardware manual test",
    "expected": "pre-fix: bogus register-base pointers from OOB const reads -> wild MMIO/hang during link encoder init on a Raven APU with foreign/crafted VBIOS; post-fix: dcn10_link_encoder_create returns NULL, dc_link_construct fails gracefully"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:744",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:745",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:746",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:1177",
    "sys/dev/drm/amd/display/include/grph_object_defs.h:81"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fix.diff", "env.txt", "verdict.json", "manifest.json"
  ],
  "fix_validated": false
}