⬢ DragonFlyBSD Kernel Audit
DF-4371 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-4371",
  "file": "sys/dev/drm/radeon/r600_dpm.c",
  "title": "Dangling dyn_state entries pointers after error-path kfree in r600_parse_extended_power_table -> double free in r600_free_extended_power_table at teardown",
  "verdict": "not_reproduced (no radeon hardware on audit VM; static proof certain)",
  "impact_real_world": "heap double free at driver unload/reboot, preconditioned on a hostile/modified VBIOS plus one induced allocation failure at attach",
  "reproduce": {
    "build": "n/a (kernel-side trigger; see trigger.md)",
    "run": "radeon DPM attach with forced kzalloc failure at r600_dpm.c:829, then driver unload (see trigger.md runbook)",
    "expected": "vulnerable: second kfree of the same pointer at r600_dpm.c:1303 (allocator corruption/panic); fixed: clean teardown, pointers NULLed"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/r600_dpm.c:939",
    "sys/dev/drm/radeon/r600_dpm.c:950-951",
    "sys/dev/drm/radeon/r600_dpm.c:962-964",
    "sys/dev/drm/radeon/r600_dpm.c:1299-1315",
    "sys/dev/drm/radeon/radeon_pm.c:1705",
    "sys/dev/drm/radeon/btc_dpm.c:2577-2579",
    "sys/dev/drm/radeon/btc_dpm.c:2727"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "trigger.md", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}