⬢ DragonFlyBSD Kernel Audit
DF-4337 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-4337",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code defect certain: atom_context carries no bios length, so every 16-bit VBIOS offset dereference in atom.c (master/data/cmd table parsers at atom.c:1366/1387, interpreter fetch loop at atom.c:1193, ID operand at atom.c:279, calltable/setdatablock at atom.c:633/848, atom_parse itself at atom.c:1298-1326) is an unbounded OOB read up to 128KB past a heap allocation that can be as small as 512 bytes (radeon_bios.c self-declared bios[2]*512). Kernel runtime could not be exercised: the audit guest has no ATI/AMD GPU (QEMU bochs vga only), so the radeon driver never attaches \u2014 the primitive was instead proven on the guest by compiling the verbatim expressions into a guard-page userland mirror: the data_header case (master entry 0x8000 vs 512-byte image) deterministically SIGSEGVs (exit 139) exactly at atom.c:1378s CU16(idx). The fix (bios_size plumbing + atom_in_bios gates, incl. the fetch loop) passes git apply --check and the fixed-logic mirror rejects the same input cleanly (exit 0).",
  "exploit_chain": "",
  "evidence": "run_cases.log [data_header] Segmentation fault exit=139; VERDICT.md table of unbounded sites with path:line; fix_run.log fixed case ok=0 exit 0; fix.diff (git apply --check OK)",
  "kernel_refs": [
    "sys/dev/drm/radeon/atom.h:125",
    "sys/dev/drm/radeon/atom.c:1193",
    "sys/dev/drm/radeon/atom.c:1298",
    "sys/dev/drm/radeon/atom.c:1366",
    "sys/dev/drm/radeon/atom.c:1387",
    "sys/dev/drm/radeon/atom.c:279",
    "sys/dev/drm/radeon/atom.c:633",
    "sys/dev/drm/radeon/atom.c:848",
    "sys/dev/drm/radeon/radeon_bios.c:146",
    "sys/dev/drm/radeon/radeon_bios.c:717"
  ],
  "poc_changes": "no seed; harness written from scratch: verbatim atom_parse_data_header + atom-bits.h macros, bios buffer placed at the end of a 16MB PROT_NONE region so OOB reads trap deterministically",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "cc -O1 -g -o atom_harness atom_harness.c (on DragonFly guest)",
  "run_cmd": "./atom_harness data_header  (expect SIGSEGV/139); ./atom_harness_fixed data_header (expect exit 0)",
  "code_hash": "25677f802601b62268f4d213ef9e2af03250f6c9a544bae5cd4cbfd214ffe6fe",
  "notes": "Hardware-gated at kernel runtime (no ATI/AMD GPU on guest; QEMU cannot emulate a radeon card with custom VBIOS). Downstream neutralization if ported to the amdgpu twin (amd/amdgpu/atom.c, same verbatim functions): DF-4104 neutralized (validated data_offset+size), DF-4152/DF-4289 partially (inner walks need per-site bounds), DF-4168 not neutralized (bios_parser2 never calls atom_parse_data_header), DF-4048 not affected (not a bounds bug).",
  "recommended_fix": "Add bios_size to atom_context, plumb the allocation length from every radeon_bios.c reader, and gate every bios-offset dereference (both master-table header parsers, the interpreter fetch loop, ID/calltable/setdatablock reads) behind an atom_in_bios(ctx, off, len) helper; port the same to amd/amdgpu/atom.c",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff passes git apply --check against the pristine tree; the fixed-logic mirror on the guest rejects the malicious master entry (ok=0, exit 0) where the baseline traps (139). A patched-kernel run is impossible on this guest (no ATOM hardware), so fixed-at-kernel-runtime is not demonstrable here.",
  "fix_evidence": "fix_run.log (data_header fixed case), fix.diff, DF-4337/VERDICT.md Fix validation section"
}