⬢ DragonFlyBSD Kernel Audit
DF-4405 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4405",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "amdgpu_uvd.c consumes common_firmware_header.ucode_size_bytes/ucode_array_offset_bytes without bounding them against the firmware blob: amdgpu_uvd.c:253 PAGE_ALIGN(ucode_size_bytes+8) wraps to 0 at 0xFFFFFFF8 (bo allocated with no fw space), amdgpu_uvd.c:405-407 resume memcpy_toio performs a ~4GiB OOB read past the kernel firmware buffer, amdgpu_uvd.c:408-411 size-=ucode_size_bytes underflows into an OOB memset_io. Only gate, amdgpu_ucode_validate (amdgpu_ucode.c:251-260), checks a different field (datasize==size_bytes). DF-1946 family instance in this file, unfiled by pass 1. Runtime execution impossible on the audit guest (no AMD GPU, /dev/dri absent) and requires root-installed firmware; exact arithmetic demonstrated deterministically (run.log): certain defect, inconclusive runtime.",
  "exploit_chain": "",
  "evidence": "run.log/run.2.log (validate=ACCEPTED, +8 wrap -> PAGE_ALIGN(0)=0, 4GiB OOB read length, memset underflow); VERDICT.md; fix.diff (git apply --check clean)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:195",
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:253",
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:403",
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:405",
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:408",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:251"
  ],
  "poc_changes": "Trigger written fresh (no seed): deterministic u32 arithmetic replica of both consumer sites for a header that passes amdgpu_ucode_validate; initial value 0xFFFFFF00 corrected to 0xFFFFFFF8 to demonstrate the clean +8 wrap.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 40,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o fw_hdr_overflow fw_hdr_overflow.c",
  "run_cmd": "/root/df4405/fw_hdr_overflow",
  "code_hash": "7747103d394dd9507826448284a9a9537245c1dd06df0471ef7c1f8517235086",
  "notes": "Reserved-ID evidence pack written by df-bsd-reviewer during pass-2 audit. Family root DF-1946 (amdgpu_ucode.c:251); siblings DF-1164/DF-1451/DF-1598/DF-1854. Precondition: root-controlled firmware + AMD hardware -> Low severity.",
  "recommended_fix": "In amdgpu_uvd_sw_init, after amdgpu_ucode_validate, reject firmware whose (u64)ucode_array_offset_bytes + ucode_size_bytes > fw->datasize (see fix.diff); mirrors the DF-1946 family fix.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff bounds the ucode extent in sw_init (which resume then inherits, blob immutable); git apply --check clean; patched-kernel A/B impossible on this guest (no AMD GPU).",
  "fix_evidence": "fix.diff; git apply --check; VERDICT.md severity/family rationale"
}