⬢ DragonFlyBSD Kernel Audit
DF-4372 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
{
  "finding_id": "DF-4372",
  "file": "sys/dev/drm/radeon/r600_dpm.c",
  "title": "Unvalidated VBIOS container offsets (usFanTableOffset, usExtendendedHeaderOffset) in r600_parse_extended_power_table -> OOB reads / extended-header pointer confusion",
  "verdict": "untested (Low severity; no radeon hardware on audit VM; defect certain by inspection)",
  "impact_real_world": "VBIOS-driven OOB kernel heap reads and misdirected ext-table parse on radeon DPM hardware",
  "reproduce": {
    "build": "n/a (firmware precondition)",
    "run": "boot radeon DPM card with crafted PowerPlayInfo (usExtendendedHeaderOffset=0 or > image size, or fan offset beyond image)",
    "expected": "vulnerable: garbage fan/ext table state parsed from wrong or out-of-image memory; fixed: offsets rejected/skipped with DRM_ERROR, attach continues"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/r600_dpm.c:893-915",
    "sys/dev/drm/radeon/r600_dpm.c:1070-1073",
    "sys/dev/drm/radeon/radeon_bios.c:68"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"
  ]
}