⬢ DragonFlyBSD Kernel Audit
DF-4577 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-4577",
  "manifest_version": 1,
  "title": "intel_hdcp_validate_v_prime KSV fill shift missing -sha_leftovers: repeater SHA-1 input stream corrupted for >=2 downstream devices, HDCP1.4 repeater auth always fails (fail-closed)",
  "file": "sys/dev/drm/i915/intel_hdcp.c",
  "verdict_summary": {
    "status": "untested",
    "kernel_level": "hardware-gated (no i915-class GPU in guest; needs Intel HSW/gen8+ display + HDCP repeater sink + DRM_MASTER)",
    "analytical": "proven by guest-compiled arithmetic simulation (run.log) + upstream v5.17 fix diff",
    "impact": "none (kernel memory safety); fail-closed loss of HDCP repeater content-protection"
  },
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "For N>=2: 'DF (old)' row diverges from the required stream at byte 5 (got 7 = 5|6, want 5); 'upstream' row emits the exact concatenation. N=1 correct in both."
  },
  "kernel_refs": [
    "sys/dev/drm/i915/intel_hdcp.c:221-223",
    "sys/dev/drm/i915/intel_hdcp.c:237-239",
    "sys/dev/drm/i915/intel_hdcp.c:262-360",
    "sys/dev/drm/i915/intel_hdcp.c:383-392",
    "sys/dev/drm/i915/intel_hdcp.c:444-455",
    "sys/dev/drm/i915/intel_hdcp.c:679-692"
  ],
  "upstream_fix_ref": "torvalds/linux v5.17+ drivers/gpu/drm/i915/display/intel_hdcp.c:529 ((sizeof(sha_text) - j - 1 - sha_leftovers) * 8); DF tree matches pre-v5.17 form (v4.17/v4.18/v5.4/v5.15-era)",
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "df4577_sim.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}