⬢ DragonFlyBSD Kernel Audit
DF-4588 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4588",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Upstream-divergence defect, certain in code, runtime hardware-gated: ttm_bo_vm_fault_dfly (ttm_bo_vm.c:499-725) lacks the upstream TTM_PAGE_FLAG_SG refusal (dead in #if 0 at ttm_bo_vm.c:161-168), so prime-imported BOs (TTM_PAGE_FLAG_SG set by amdgpu_ttm.c:1272-1280 / radeon_ttm.c:747; prime ioctls live at drm_ioctl.c:651-652) fault the exporters pages through the card node and pmap_page_set_memattr mutates the cache attribute of pages TTM does not own (ttm_bo_vm.c:669,695-697). No kernel memory corruption by itself; cross-driver page-attribute/coherency impact. Not runnable on the audit guest (no DRM device); no runtime attempt made \u2014 PoC is a documentation stub plus the one-line port fix in README.md.",
  "exploit_chain": "on amdgpu/radeon hardware: GEM_CREATE -> PRIME_HANDLE_TO_FD -> PRIME_FD_TO_HANDLE (self-import creates SG ttm_tt) -> GEM_MMAP ioctl -> mmap(card node, fake offset) -> touch -> foreign SG pages mapped with TTM-chosen attributes",
  "evidence": "README.md (code cites + ported upstream check); df4588.c (flow documentation)",
  "kernel_refs": [
    "sys/dev/drm/ttm/ttm_bo_vm.c:161",
    "sys/dev/drm/ttm/ttm_bo_vm.c:584",
    "sys/dev/drm/ttm/ttm_bo_vm.c:690",
    "sys/dev/drm/ttm/ttm_bo_vm.c:695",
    "sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:1280"
  ],
  "poc_changes": "no seed; documentation stub (full trigger requires amdgpu UAPI + hardware)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (documentation stub)",
  "run_cmd": "n/a (requires radeon/amdgpu hardware)",
  "code_hash": "skip",
  "notes": "Low severity; PoC skipped per Phase V rules (runtime needs TTM-capable GPU; guest has none). Fix is a 8-line port of the upstream check into the live fault, shown in README.md.",
  "recommended_fix": "Port the upstream TTM_PAGE_FLAG_SG refusal from the #if 0 body into ttm_bo_vm_fault_dfly (return VM_PAGER_ERROR before fault_reserve_notify)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "one-line port of the upstream check (README.md); not compile-validated separately \u2014 trivially contained in the same fault function rebuilt for DF-4587s fix (ttm_bo_vm.c compiles -Werror clean in drm.ko)",
  "fix_evidence": "README.md diff hunk"
}