⬢ DragonFlyBSD Kernel Audit
DF-4545 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-4545",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "vega20 pptable init reports SUCCESS with NULL overdrive arrays: the ucODTableRevision==1 gate (vega20_processpptables.c:823) silently skips all three OD copies for any other legal revision value, and the five copy-helper return codes are ignored (:835-846, :870-877) so a kzalloc failure leaves the pointers NULL too; init then returns append_vbios_pptables 0 (:889-891). backend_init runs right after (hwmgr.c:229 after :222) and vega20_od8_initialize_default_settings (vega20_hwmgr.c:1598) calls vega20_od8_set_feature_capabilities whose first array access (vega20_hwmgr.c:906, od_feature_capabilities[0]) dereferences NULL -> kernel panic at amdgpu driver load. Reproduced on the audit guest with a faithful lifted-copy harness: VARIANT A (crafted ucODTableRevision=2 that passes every header check) -> init SUCCESS with od_feature_capabilities=0x0 -> consumer SIGSEGV at address 0x0; VARIANT B (rev=1 with injected kzalloc failure, the dropped -ENOMEM) -> identical fault; CONTROL (rev=1 healthy) clean; PATCHED (fix.diff: checked returns + refuse-to-succeed-with-NULL) rejects the table at init (-EINVAL) and no fault occurs. In-kernel path hardware-gated (no AMD GPU on the guest).",
  "exploit_chain": "crafted VBIOS/vGPU ROM with OverDrive8Table.ucODTableRevision != 1 (or memory pressure during pptable init) -> pptable_init succeeds with NULL od arrays -> vega20_od8_set_feature_capabilities NULL-deref at driver load -> kernel panic (DoS); no data control, fixed NULL offset",
  "evidence": "run.log (VARIANT A/B: >>> SIGSEGV: fault address 0x0 (od_feature_capabilities + 0) + PANIC-CLASS FAULT REPRODUCED; CONTROL clean; PATCHED refuses init, no fault); run.2.log (repeat); fix_build.log (full amdgpu.ko rebuild with fix.diff, -Werror, RC=0); fix.diff (git apply --check OK)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:823",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:835",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:839",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:843",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:870",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:874",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:889",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:906",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:1598",
    "sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:222",
    "sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:229"
  ],
  "poc_changes": "authored fresh this run (pass 2); no seed PoC existed",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh  (cc -O2 -Wall -o od_null_deref od_null_deref.c on the guest)",
  "run_cmd": "sh run.sh  (./od_null_deref)",
  "code_hash": "97242d7d577fb00d2cc1ea71b6a54a0758c8caa2a5df42f3b659601a1fac0739",
  "notes": "lifted-copy harness per DF-1179/DF-4395 convention (needs a Vega20 ASIC for the in-kernel path; guest has only the QEMU std VGA -- env.txt). Also note :857 reads ODSettingsMax[POWERPERCENTAGE] unconditionally even when the revision gate skipped OD parsing -- garbage TDPODLimit can enable PHM_PlatformCaps_PowerControl; folded into this findings fix (the NULL guard rejects unparsed tables).",
  "recommended_fix": "check the five copy-helper return codes and fail init (-EINVAL) when the OD revision is unsupported instead of reporting success with NULL arrays (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched kernel not runnable on the guest (no AMD ASIC). fix.diff is git-apply-able, compiles clean in a full amdgpu.ko module build under the real kernel toolchain with -Werror (fix_build.log, RC=0), and the harness PATCHED control rejects the crafted table at init with no consumer fault.",
  "fix_evidence": "fix.diff; fix_build.log (module rebuild RC=0, 0 errors); run.log PATCHED case (init refuses -EINVAL, no fault)",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 x86_64 (amdgpu.ko toolchain validation)"
}