⬢ DragonFlyBSD Kernel Audit
DF-4396 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
{
  "finding_id": "DF-4396",
  "title": "CENTRAL FIX: Vega10 PowerPlay parser has no bounds-validation layer — every firmware USHORT offset / UCHAR count consumed unvalidated (vega10 side of DF-4388)",
  "verdict": "REPRODUCED via the DF-4165/DF-4247 verbatim-rig evidence class + fix A/B-validated (fixed)",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh /usr/src   (on the DF guest: verbatim checks + rig_base + rig_fixed)",
    "run": "./run.sh               (23 modes, baseline vs fixed)",
    "expected": "baseline: 16 SIGSEGVs at the exact predicted sites (deep +65281 offsets, image_end tail reads, NULL 0x0, heap OOB writes obj+86/obj+232), 247/247 + 1232-byte attacker-controlled canary overwrites, 73 OOB records byte-exact leaked, rc=0-with-NULL-table; fixed: every mode clean, clean-valid identical"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:72",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:82",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:127",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:166",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:210",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:262",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:273",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:302",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:392",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:472",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:528",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:592",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:631",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:659",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:695",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:721",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:757",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:781",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:810",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:861",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1014",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1036",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1103",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1246",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1308",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_pptable.h:73",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_pptable.h:147",
    "sys/dev/drm/amd/powerplay/amd_powerplay.c:671"
  ],
  "artifacts": [
    "rig/gen_rig.sh", "rig/check_verbatim.sh", "rig/rig_shims.h",
    "rig/vega10_rig.c", "rig/Makefile", "rig/build.sh", "rig/run.sh",
    "fix.diff", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "run.3.log",
    "leak_sample.txt", "env.txt", "README.md", "VERDICT.md",
    "manifest.json", "verdict.json"
  ]
}