⬢ DragonFlyBSD Kernel Audit
DF-4357 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-4357",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain hardening gap: amdgpu_kms.c:668-684 passes user-controlled read_mmr_reg.count (u32) into kmalloc_array with no bound, while upstream v5.4+ caps it at 128; the DF trees ~v5.0 base never received the cap (v5.0 upstream verified to also lack it). Not memory corruption: loop and copy are allocation- and min()-bounded. Practical abuse is limited to unprivileged render clients forcing repeated large kernel allocations (M_WAITOK stall / memory pressure) since the register-allowlist loop bails at the first unlisted offset. Runtime reproduction hardware-gated (no AMD GPU, no /dev/dri, no UAPI header on the audit guest - run.log/env.txt), so inconclusive per house style (DF-1467/DF-1595).",
  "exploit_chain": "open render node -> AMDGPU_INFO{query=READ_MMR_REG, count=0x08000000} -> 512MiB kernel kmalloc attempted per call -> repeated ENOMEM/alloc stalls (kernel memory pressure DoS). No user->root route; class does not permit escalation.",
  "evidence": "README.md (diff vs upstream v5.4 with cap); VERDICT.md (bounds analysis proving no OOB, truncation unreachable); run.log/env.txt (guest hardware-absent); trigger.c (compile-ready); fix_apply_check.log + fix_build.log (cap compiles in patched buildkernel)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:668",
    "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:671",
    "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:673"
  ],
  "poc_changes": "n/a (authored fresh; no seed)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 1,
  "build_cmd": "cc -O2 -o trigger trigger.c (guest lacks drm/amdgpu_drm.h - host-side build only)",
  "run_cmd": "./trigger /dev/dri/renderD128",
  "code_hash": "34f4a84aa346fcbe523c5b70b067d5cca358847aa15b4303915d068855125334",
  "notes": "Low-severity hardening; upstream cap added post-v5.0. Honest negative runtime: device absent. Guest dirtied by fix-validation buildkernel; reset with-src at end of run.",
  "recommended_fix": "Add upstreams if (info->read_mmr_reg.count > 128) return -EINVAL; before the kmalloc_array in amdgpu_info_ioctls AMDGPU_INFO_READ_MMR_REG case.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 (buildkernel compile-validation only)",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the verbatim upstream cap. patch --dry-run apply-check OK on guest pristine /usr/src; with the fix applied the amdgpu module rebuilt cleanly (make -j6 -> amdgpu.ko, zero warnings, mod_done_0, fix_build.log). Behavioral test needs an AMD GPU (EINVAL-vs-ENOMEM oracle documented in trigger.c), unavailable on this guest.",
  "fix_evidence": "fix_apply_check.log (DF-4357_APPLY_CHECK_OK); fix_build.log (FULL module build: amdgpu_kms.o zero warnings, amdgpu.ko linked, mod_done_0)"
}