⬢ DragonFlyBSD Kernel Audit
DF-4429 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{
 "verdict": "source-verified",
 "impact": "cross-user GPU memory read/write (video-group gated)",
 "reproduce": {
  "build": "cc -O2 -o poc_mmap_bo poc_mmap_bo.c && cc -O2 -o victim_bo victim_bo.c",
  "run": "userA: ./victim_bo ; userB: ./poc_mmap_bo --read",
  "expected": "attacker sweep prints HITs; a hit page dump contains victim's DF4429MARK pattern in a BO the attacker holds no handle for; after fix (or on amdgpu) verify_access returns EACCES and foreign hits vanish"
 },
 "kernel_refs": [
  "sys/dev/drm/radeon/radeon_ttm.c:234",
  "sys/dev/drm/radeon/radeon_ttm.c:849",
  "sys/dev/drm/radeon/radeon_ttm.c:882",
  "sys/dev/drm/ttm/ttm_bo_vm.c:447",
  "sys/dev/drm/ttm/ttm_bo.c:1266",
  "sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:311",
  "sys/dev/drm/drm_drv.c:1254",
  "sys/dev/drm/drm_gem.c:471"
 ],
 "artifacts": [
  "README.md", "VERDICT.md", "poc_mmap_bo.c", "victim_bo.c",
  "build.sh", "run.sh", "fix.diff", "env.txt", "verdict.json", "manifest.json"
 ]
}