⬢ DragonFlyBSD Kernel Audit
DF-4348 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4348",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "UB certain, impact low (hardening/correctness): amdgpu ATOM shift counts are untrusted VBIOS values used unmasked -- atom_op_shl/shr (atom.c:958/977) shift by a full 32-bit operand, shift_left/right (atom.c:925/941) by a u8, WS OR/AND masks (atom.c:241/244) use gctx->shift (u8 truncated from a u32 write at atom.c:508), and the IIO masks (atom.c:121-157) compute 0xFFFFFFFF >> (32 - width) with width 0 or >32. Counts >= width are undefined; on the audit guests gcc 8.3 -O1 the same expression constant-folds to a DIFFERENT result than runtime x86 masking (0xffff << 40 folds to 0 while masking semantics give 0xffff << 8 = 0x00ffff00; >> 32 folds away entirely) -- the interpreters computed register/MMIO values are compiler-version dependent. amdgpu twin of DF-4340 (radeon); previously unfiled for amdgpu. No memory-safety primitive by itself.",
  "exploit_chain": "",
  "evidence": "run.log case shift (divergence report: <<40 folds to 0, >>32 mask dropped, 1<<200 = 0); fix.diff (atom_shl/atom_shr port, git apply --check OK); fix_run.log case shift (defined semantics)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/atom.c:121",
    "sys/dev/drm/amd/amdgpu/atom.c:241",
    "sys/dev/drm/amd/amdgpu/atom.c:244",
    "sys/dev/drm/amd/amdgpu/atom.c:508",
    "sys/dev/drm/amd/amdgpu/atom.c:925",
    "sys/dev/drm/amd/amdgpu/atom.c:941",
    "sys/dev/drm/amd/amdgpu/atom.c:958",
    "sys/dev/drm/amd/amdgpu/atom.c:977"
  ],
  "poc_changes": "shift case adds the amdgpu shl full-u32 operand and the u8-truncated gctx->shift (200) demonstrations on top of DF-4340s",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O1 -g -o atom_harness atom_harness.c",
  "run_cmd": "./atom_harness shift (UB divergence report, exit 0)",
  "code_hash": "5356b23349edbb49469348db664a12cf6437fa43fe980eef7d322939a6da7eba",
  "notes": "amdgpu twin of DF-4340; fix.diff mirrors DF-4340s scope (shl/shr/shift_left/shift_right/WS masks); IIO width-mask sites noted as residual hardening",
  "recommended_fix": "Define the hardware semantics (shift >= 32 yields 0) via atom_shl/atom_shr helpers used at the four shift op sites and the WS OR/AND masks; mask IIO width bytes the same way",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (atom_shl/atom_shr port) passes git apply --check; the fixed-logic demo returns defined values for the same inputs. No kernel runtime possible on this guest.",
  "fix_evidence": "fix.diff; fix_run.log case shift"
}