⬢ DragonFlyBSD Kernel Audit
DF-4388 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-4388",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED via the DF-4165/4247/4396 verbatim-rig evidence class: the ENTIRE production V1 parser (process_pptables_v1_0.c:34-1337, checker-proven byte-identical on the guest against /usr/src/sys, the tree its running kernel was built from) compiled into a harness and driven with crafted Tonga-format PowerPlay tables. 16 defect modes demonstrated at exactly the predicted verbatim sites, stable across 3 identical runs: (1) heap OOB WRITE in get_vddc_lookup_table (:176-190) - firmware ucNumEntries=255 bounds the copy loop into a fixed kzalloc(4+10*16=164) destination, fault at the first byte past the allocation, up to ~2390B of firmware-chosen content (both usVddcLookupTableOffset and usVddgfxLookupTableOffset paths); (2) six unvalidated USHORT-offset dereferences (state/thermal/fan/sclk-dep/ppm/vce) faulting at image+0xFF00; (3) count-bounded source OOB read loops (sclk 255 vs 3 records); (4) byte-exact kernel-heap leak: MM dep count=40 vs 5 records -> 175/175 parsed field values byte-exact with victim bytes past the image, parse completing into userland-readable DPM tables; (5) VCE ucSCLKIndex=0xFF -> entries[0xFF] read at sclk_table+2+2805; (6) entries[-1] NEGATIVE-INDEX underflow read before the image when ucNumEntries=0 (:1263-1267); (7) entry_index<=ucNumEntries off-by-one (:1310); (8) NULL derefs of vdd_dep_on_sclk in get_pcie_table/get_gpio_table (:522/:745); (9) the never-NULL GPIO gate parsing the PowerPlay header when usGPIOTableOffset==0; (10) num_vce_state_tables stored unclamped (200 vs vce_states[6], :1328). Fix A/B-validated in the same rig: fix.diff (git-apply proven bidirectionally, byte-equal to the packed reference) applied to the same slice -> 0 SIGSEGVs on identical input, counts clamped to image AND destination constants (255->16 lookup, 255->3 sclk, 40->5 mm, 200->6 vce), offsets rejected (rc=-1/-22), indices clamped, entries[-1] gone, NULL guards added, GPIO gate moved to the offset, and clean-valid parses byte-identically in both builds. In-kernel execution is AMD-ASIC-gated on this guest (no 1002: device, hw_probe.log); impact recorded as dos = the realistic in-kernel floor of the demonstrated heap-corruption primitive (panic), with content-controlled overwrite potential; threat model is VBIOS-crafted (flashed ROM / vfio romfile / malicious device) or root-written pp_table, same class as the DF-4247 V0 twin - no unprivileged userland trigger on stock hardware.",
  "exploit_chain": "crafted/corrupted GPU VBIOS PowerPlay table (Tonga format, PP_TABLE_V1: Tonga/Fiji/Polaris10/11/12/VegaM) at driver attach -> pptable_v1_0_initialize -> get_vddc_lookup_table heap OOB write (255 firmware entries into a 16-record kmalloc(164), ~2390B content-controlled overwrite) and/or OOB reads with byte-exact leak into userland-readable DPM tables and/or vdd_dep_on_sclk NULL-deref panic; alternatively root-written /sys/class/drm/card0/device/pp_table -> pp_dpm_set_pp_table -> amd_powerplay_reset -> same parse. No unprivileged userland route on stock hardware.",
  "evidence": "run.log (baseline 13 classified SIGSEGVs at exact predicted offsets + 175/175 byte-exact leak + 2 behavioral proofs; FIXED half: 0 faults, all clamps visible; byte-identical across run.2.log/run.3.log); build.log (ALL VERBATIM CHECKS PASSED vs guest /usr/src, 24 blocks + bidirectional fix proof); VERDICT.md (full path:line trace); rig/ (pp_rig.c 18 modes, gen_rig.sh, check_verbatim.sh); env.txt (guest md5s = host tree)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:176",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1042",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:522",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:745",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1263",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1310",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1328",
    "sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:86",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:5144"
  ],
  "poc_changes": "fresh rig this run (no prior PoC existed - prior verification was compile-validation + clamp unit test only): guard-backed end-anchored kzalloc shim to make the destination heap OOB write fault decisively; 18-mode driver (16 defect modes + layout + clean-valid regression control); verbatim slice of the whole parser body + 24 header slices with guest-side byte-identity proof",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "./build.sh /usr/src (guest-side: check_verbatim vs /usr/src + make rig_base rig_fixed, cc 8.3)",
  "run_cmd": "./run.sh (baseline vs fixed A/B over 18 modes; 3 identical runs)",
  "code_hash": "bfc04eb6312476d813145c0af98750fcff4b71ec24fb31412ce2ab9f4e6a35ae",
  "notes": "Verbatim-rig evidence class (DF-4165/4247/4396): production parser machine-extracted, checker-proven byte-identical on the guest against the tree its running kernel was built from, compiled and driven with crafted tables; all 13 fault modes fault at the exact cited path:line offsets; leak leg 175/175 byte-exact across 3 runs. Guest /usr/src verified pristine (md5) after the run. Baseline faults are exit=88 (handler-classified); the FIXED build shows 0 SIGSEGV and clean-valid parses byte-identically. Historical pre-verification artifacts retained: syntax_check_guest.txt, unit_test_guest.log (11/11), v1_clamp_test.c, process_pptables_v1_0_fixed.c.",
  "recommended_fix": "central pp_v1_table_range_ok/pp_v1_clamp_count layer with destination-constant clamps at every offset/count/index consumer (fix.diff, A/B-validated in the rig)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "A/B-validated in the verbatim rig (DF-4165/4247/4396 protocol): rig_fixed = same byte-identical slice + fix.diff (patch --fuzz=0, reverse-apply restores pristine byte-exactly; byte-equal to the packed process_pptables_v1_0_fixed.c). On the identical crafted inputs that fault the baseline 13 times, the fixed build faults ZERO times: vddc lookup count clamped 255->16 (write gone), oversized USHORT offsets rejected (rc=-1/-22), dep counts clamped to image and destination constants (255->3 sclk, 40->5 mm), VCE indices clamped, entries[-1] underflow eliminated, entry_index guard corrected to <, vdd_dep_on_sclk NULL guards added (rc=-22), GPIO gate moved to the offset, num_vce_state_tables clamped 200->6; clean-valid table parses byte-identically to the baseline build. A rebuilt-kernel A/B was not performed: the fix sites execute in-kernel only on AMD ASICs absent from this guest.",
  "fix_evidence": "run.log FIXED half (0 SIGSEGV / 11 graceful rejections + clamped counts); build.log (verbatim checks + bidirectional fix proof); fix.diff"
}